// Decompiled with JetBrains decompiler
// Type: A.G
// Assembly: RansomGuard, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 37652FF6-4FF5-4E76-944D-E6CA5073036F
// Assembly location: RansomGuard.dll inside C:\Users\WDAGUtilityAccount\Desktop\RansomGuard.exe)

using System;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Text;

#nullable enable
namespace A;

internal static class G
{
  internal static readonly IntPtr Bx = new IntPtr(1);
  internal const uint BY = 1;
  internal const uint By = 2;
  internal const uint BZ = 16 /*0x10*/;
  internal const uint Bz = 2;
  internal static readonly IntPtr bA = new IntPtr(-1);
  internal const int ba = 20;
  internal const int bB = 19;

  [DllImport("kernel32.dll", EntryPoint = "OpenProcess", SetLastError = true)]
  internal static extern IntPtr A([In] G.ProcessAccessFlags obj0, [In] bool obj1, [In] int obj2);

  [DllImport("kernel32.dll", EntryPoint = "CloseHandle", SetLastError = true)]
  internal static extern bool A([In] IntPtr obj0);

  [DllImport("kernel32.dll", EntryPoint = "QueryFullProcessImageName", CharSet = (CharSet) 3)]
  internal static extern bool A([In] IntPtr obj0, [In] int obj1, [In] StringBuilder obj2, out int _param3);

  [DllImport("shell32.dll", EntryPoint = "SetCurrentProcessExplicitAppUserModelID", CharSet = (CharSet) 3, SetLastError = true)]
  internal static extern int A([In] string obj0);

  [DllImport("user32.dll", EntryPoint = "SetWindowPos")]
  internal static extern bool A(
    [In] IntPtr obj0,
    [In] IntPtr obj1,
    [In] int obj2,
    [In] int obj3,
    [In] int obj4,
    [In] int obj5,
    [In] uint obj6);

  [DllImport("kernel32.dll", EntryPoint = "TerminateProcess", SetLastError = true)]
  internal static extern bool A([In] IntPtr obj0, [In] uint obj1);

  [SpecialName]
  internal static uint A() => 2;

  [DllImport("kernel32.dll", EntryPoint = "CreateToolhelp32Snapshot", SetLastError = true)]
  internal static extern IntPtr A([In] uint obj0, [In] uint obj1);

  [DllImport("kernel32.dll", EntryPoint = "Process32First", CharSet = (CharSet) 4, SetLastError = true)]
  internal static extern bool A([In] IntPtr obj0, [In] ref G.a obj1);

  [DllImport("kernel32.dll", EntryPoint = "Process32Next", CharSet = (CharSet) 4, SetLastError = true)]
  internal static extern bool a([In] IntPtr obj0, [In] ref G.a obj1);

  [DllImport("ntdll.dll", EntryPoint = "NtQueryInformationProcess", SetLastError = true)]
  internal static extern int A([In] IntPtr obj0, [In] int obj1, [In] ref G.B obj2, [In] int obj3, [In] ref int obj4);

  [DllImport("kernel32.dll", EntryPoint = "QueryDosDevice", CharSet = (CharSet) 3, SetLastError = true)]
  internal static extern uint A([In] string obj0, [In] StringBuilder obj1, [In] int obj2);

  [DllImport("kernel32.dll", EntryPoint = "GetVolumeInformation", CharSet = (CharSet) 3, SetLastError = true)]
  internal static extern bool A(
    [In] string obj0,
    [In] StringBuilder obj1,
    [In] int obj2,
    out uint _param3,
    out uint _param4,
    out uint _param5,
    [In] StringBuilder obj6,
    [In] int obj7);

  [DllImport("ntdll.dll", EntryPoint = "NtSuspendProcess")]
  internal static extern uint a([In] IntPtr obj0);

  [DllImport("ntdll.dll", EntryPoint = "NtResumeProcess")]
  internal static extern uint B([In] IntPtr obj0);

  [DllImport("advapi32.dll", EntryPoint = "OpenProcessToken", SetLastError = true)]
  internal static extern bool A([In] IntPtr obj0, [In] G.TokenAccess obj1, out IntPtr _param2);

  [DllImport("advapi32.dll", EntryPoint = "GetTokenInformation", SetLastError = true)]
  internal static extern int A([In] IntPtr obj0, [In] int obj1, [In] IntPtr obj2, [In] uint obj3, out uint _param4);

  [DllImport("kernel32.dll", EntryPoint = "GetProcessInformation", SetLastError = true)]
  internal static extern bool A(
    [In] IntPtr obj0,
    [In] G.PROCESS_INFORMATION_CLASS obj1,
    [In] IntPtr obj2,
    [In] uint obj3);

  [DllImport("dwmapi.dll", EntryPoint = "DwmSetWindowAttribute")]
  internal static extern int A([In] IntPtr obj0, [In] int obj1, [In] ref int obj2, [In] int obj3);

  [Flags]
  internal enum ProcessAccessFlags : uint
  {
    Terminate = 1,
    SuspendResume = 2048, // 0x00000800
    QueryInformation = 1024, // 0x00000400
    QueryLimitedInformation = 4096, // 0x00001000
    VirtualMemoryRead = 16, // 0x00000010
  }

  [StructLayout((LayoutKind) 0, CharSet = (CharSet) 4)]
  internal struct a
  {
    public uint EO;
    public uint Eo;
    public uint EP;
    public IntPtr Ep;
    public uint EQ;
    public uint Eq;
    public uint ER;
    public int Er;
    public uint ES;
    [MarshalAs((UnmanagedType) 23, SizeConst = 260)]
    public string Es;
  }

  internal struct B
  {
    public int ET;
    public IntPtr Et;
    public IntPtr EU;
    public int Eu;
    public IntPtr EV;
    public int Ev;
  }

  [Flags]
  internal enum TokenAccess : uint
  {
    Query = 8,
  }

  internal enum PROCESS_INFORMATION_CLASS
  {
    ProcessProtectionLevelInfo = 43, // 0x0000002B
  }
}
