// Decompiled with JetBrains decompiler
// Type: A.l
// Assembly: RansomGuard, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 37652FF6-4FF5-4E76-944D-E6CA5073036F
// Assembly location: RansomGuard.dll inside C:\Users\WDAGUtilityAccount\Desktop\RansomGuard.exe)

using \u003CPrivateImplementationDetails\u003E\u007B29195D03\u002D3E0A\u002D468D\u002DA5D2\u002D1BA9D027086D\u007D;
using RansomGuard;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

#nullable enable
namespace A;

public sealed class l
{
  private readonly object CE = new object();
  private readonly Dictionary<int, g> Ce = new Dictionary<int, g>();
  private readonly Dictionary<int, l.a> CF = new Dictionary<int, l.a>();
  private readonly RansomGuardConfig Cf;
  private readonly A.A CG;
  private readonly TimeSpan Cg;

  public event EventHandler<f>? ThreatDetected;

  public l([In] RansomGuardConfig obj0, [In] A.A obj1)
  {
    this.Cf = obj0;
    this.CG = obj1;
    TimeSpan timeSpan;
    switch (obj0.DetectionPosture)
    {
      case DetectionPosture.Conservative:
        timeSpan = TimeSpan.FromSeconds(180.0);
        break;
      case DetectionPosture.Aggressive:
        timeSpan = TimeSpan.FromSeconds(30.0);
        break;
      default:
        timeSpan = TimeSpan.FromSeconds(60.0);
        break;
    }
    this.Cg = timeSpan;
  }

  public void A([In] int obj0, [In] string obj1, [In] string obj2, [In] string obj3, [In] string obj4)
  {
    string str = string.Empty;
    double num1 = 0.0;
    if (!string.IsNullOrWhiteSpace(obj3))
    {
      str = Path.GetExtension(obj3) ?? string.Empty;
      num1 = this.A(obj3);
    }
    lock (this.CE)
    {
      g g1;
      if (!this.Ce.TryGetValue(obj0, ref g1))
      {
        g1 = this.A(obj0, obj1, obj2);
        if (l.B(g1.fg))
          return;
        this.a(g1);
        this.Ce[obj0] = g1;
      }
      g1.a(DateTime.UtcNow);
      g g2 = g1;
      g2.a(g2.D() + 1);
      bool flag = obj4.Equals(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.j(), (StringComparison) 5) || obj4.Equals(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.K(), (StringComparison) 5);
      int num2 = obj4.Equals(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.h(), (StringComparison) 5) ? 1 : (obj4.Equals(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.I(), (StringComparison) 5) ? 1 : 0);
      if (flag)
      {
        g g3 = g1;
        g3.B(g3.d() + 1);
      }
      if (num2 != 0)
      {
        g g4 = g1;
        g4.b(g4.E() + 1);
      }
      if (!string.IsNullOrWhiteSpace(obj3) && g1.fH.Count < 100)
        g1.fH.Add(obj3);
      if (num2 != 0)
        this.A(g1.A(), str, g1.J());
      this.A(g1, flag);
      if (this.A(g1, str) && num1 > 0.0)
        this.A(g1, num1);
      if (l.B(g1.fg) || !g1.b().HasValue)
        return;
      this.B(g1);
    }
  }

  private double A([In] string obj0)
  {
    try
    {
      return this.CG.e(obj0);
    }
    catch
    {
      return 0.0;
    }
  }

  private void A([In] g obj0, [In] double obj1)
  {
    if (obj0.F() <= 0.0)
      obj0.A(obj1);
    else
      obj0.A(obj1 * 0.15 + obj0.F() * 0.85);
    if (obj1 > obj0.f())
      obj0.a(obj1);
    if (obj1 < this.Cf.EntropyThreshold)
      return;
    g g = obj0;
    g.c(g.G() + 1);
  }

  private static bool a([In] string obj0)
  {
    return !string.IsNullOrWhiteSpace(obj0) && h.bQ.Contains(obj0);
  }

  private void A([In] int obj0, [In] string obj1, [In] bool obj2)
  {
    DateTime utcNow = DateTime.UtcNow;
    l.a a;
    if (!this.CF.TryGetValue(obj0, ref a))
    {
      a = new l.a() { eF = utcNow, ef = l.WiperTier.None };
      this.CF[obj0] = a;
    }
    if (TimeSpan.op_GreaterThan(DateTime.op_Subtraction(utcNow, a.eF), TimeSpan.FromSeconds(1.0)))
    {
      a.eF = utcNow;
      a.ee = 0;
    }
    ++a.ed;
    ++a.ee;
    if (l.a(obj1))
      ++a.eE;
    int num1 = obj2 ? 20 : 40;
    int num2 = obj2 ? 8 : 15;
    int num3 = obj2 ? 60 : 120;
    int num4 = obj2 ? 20 : 40;
    int num5 = obj2 ? 25 : 40;
    int num6 = obj2 ? 150 : 300;
    int num7 = obj2 ? 60 : 100;
    l.WiperTier wiperTier = a.ef;
    if (a.ed >= num1 && a.eE >= num2)
      wiperTier = l.WiperTier.Tier1;
    if (a.ee >= num5 || a.ed >= num3 && a.eE >= num4)
      wiperTier = l.WiperTier.Tier2;
    if (a.ee >= num7 || a.ed >= num6)
      wiperTier = l.WiperTier.Tier3;
    a.ef = wiperTier;
  }

  private g A([In] int obj0, [In] string obj1, [In] string obj2)
  {
    g g = new g();
    g.A(obj0);
    g.fG = string.IsNullOrWhiteSpace(obj1) ? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.m() : string.Intern(obj1);
    g.fg = string.IsNullOrWhiteSpace(obj2) ? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.DO() : string.Intern(obj2);
    g.A(DateTime.UtcNow);
    g.B(DateTime.UtcNow);
    l.A(g);
    return g;
  }

  private static bool B([In] string? obj0)
  {
    if (string.IsNullOrWhiteSpace(obj0))
      return true;
    obj0 = obj0.Trim();
    return obj0.Equals(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.DO(), (StringComparison) 5) || obj0.Equals(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eO(), (StringComparison) 5) || obj0.Contains(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eo(), (StringComparison) 5) || !obj0.StartsWith(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.p()) && !Path.IsPathRooted(obj0) && !obj0.Contains(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eP());
  }

  private static void A([In] g obj0)
  {
    try
    {
      obj0.A(l.A(obj0.A()));
    }
    catch
    {
      obj0.A(new int?());
    }
    try
    {
      F f = H.a(obj0.A());
      if (f == null)
        return;
      if (string.IsNullOrWhiteSpace(obj0.fg))
        obj0.fg = f.B() ?? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.DO();
      if (!string.IsNullOrWhiteSpace(obj0.fG))
        return;
      obj0.fG = f.a() ?? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.m();
    }
    catch
    {
    }
  }

  private void a([In] g obj0)
  {
    if (!this.Cf.EnableLolBinProtection)
      return;
    obj0.A(D.A(obj0.fg, this.Cf));
    if (!obj0.i())
      return;
    int? nullable = obj0.b();
    if (!nullable.HasValue)
      return;
    try
    {
      nullable = obj0.b();
      string parentPath = H.a(nullable.Value)?.B();
      if (D.a(parentPath, this.Cf))
        return;
      obj0.a(true);
      obj0.B(D.A(parentPath == null ? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.m() : Path.GetFileName(parentPath), parentPath, obj0.fG, obj0.fg));
      g g = obj0;
      g.d(g.K() + 35);
    }
    catch
    {
    }
  }

  private void A([In] g obj0, [In] bool obj1)
  {
    DateTime dateTime = obj0.c();
    if (TimeSpan.op_GreaterThan(DateTime.op_Subtraction(dateTime, obj0.H()), TimeSpan.FromSeconds(1.0)))
    {
      obj0.B(dateTime);
      obj0.D(0);
    }
    if (obj1)
    {
      g g = obj0;
      g.D(g.g() + 1);
    }
    if (obj0.g() < 20)
      return;
    int num1 = obj0.g();
    int num2 = num1 >= 100 ? 10 : (num1 >= 50 ? 6 : 3);
    obj0.b(dateTime.AddSeconds((double) num2));
  }

  private bool A([In] g obj0, [In] string obj1)
  {
    return DateTime.op_LessThan(obj0.c(), obj0.h()) || obj0.e() > 0 || obj0.d() <= 3 || l.a(obj1) || obj0.d() % 8 == 0;
  }

  private void B([In] g obj0)
  {
    int num1 = 0 + obj0.e() * 3 + obj0.G() * 2;
    if (obj0.d() > 20)
      num1 += 2;
    if (obj0.d() > 50)
      num1 += 3;
    if (obj0.D() > 100)
      num1 += 2;
    if (obj0.E() >= 10)
      num1 += 4;
    if (obj0.E() >= 50)
      num1 += 8;
    if (obj0.E() >= 150)
      num1 += 12;
    l.a ds = (l.a) null;
    l.a a;
    if (this.CF.TryGetValue(obj0.A(), ref a))
    {
      ds = a;
      num1 += Math.Min(a.ed / 10, 15);
      switch (a.ef)
      {
        case l.WiperTier.Tier1:
          num1 += 10;
          break;
        case l.WiperTier.Tier2:
          num1 += 25;
          break;
        case l.WiperTier.Tier3:
          num1 += 45;
          break;
      }
    }
    if (this.Cf.LockdownMode)
      num1 += 3;
    if (obj0.J())
      num1 += 35;
    bool flag1 = obj0.k() == SignerStatus.Trusted && obj0.fg.StartsWith(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.ep(), (StringComparison) 5);
    if (flag1)
    {
      num1 -= 20;
      if (num1 < 0)
        num1 = 0;
    }
    obj0.d(num1);
    int num2 = this.Cf.MinimumScore;
    int num3 = this.Cf.MinimumFiles;
    switch (this.Cf.DetectionPosture)
    {
      case DetectionPosture.Conservative:
        num2 += 3;
        num3 += 2;
        break;
      case DetectionPosture.Aggressive:
        num2 = Math.Max(5, num2 - 3);
        num3 = Math.Max(3, num3 - 2);
        break;
    }
    bool flag2 = obj0.e() >= num3 && obj0.K() >= num2;
    bool flag3 = false;
    if (ds != null)
    {
      switch (this.Cf.WiperSensitivity)
      {
        case WiperSensitivity.Conservative:
          flag3 = ds.ef >= l.WiperTier.Tier3 && obj0.K() >= num2;
          break;
        case WiperSensitivity.Recommended:
          flag3 = ds.ef >= l.WiperTier.Tier2 && obj0.K() >= num2;
          break;
        case WiperSensitivity.Aggressive:
          flag3 = ds.ef >= l.WiperTier.Tier1 && obj0.K() >= num2;
          break;
      }
    }
    if (flag1 && (ds != null && ds.ef < l.WiperTier.Tier3 || (obj0.e() > 0 ? 1 : (obj0.G() >= 5 ? 1 : 0)) == 0) || !(flag2 | flag3))
      return;
    this.A(obj0, ds);
  }

  private void A([In] g obj0, l.a? ds)
  {
    f f1 = new f();
    f1.A(obj0.A());
    f1.fC = obj0.fG ?? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.m();
    f1.fc = obj0.fg ?? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.DO();
    f1.D(obj0.K());
    f1.fE = obj0.e();
    f1.fe = obj0.G();
    f1.fF = obj0.D();
    f1.C(obj0.d());
    f1.c(obj0.E());
    f1.A(obj0.F());
    f1.a(obj0.f());
    f1.fD = new List<string>((IEnumerable<string>) obj0.fH);
    f1.A(obj0.J());
    f1.F(obj0.j());
    f f2 = f1;
    if (obj0.J())
      f2.fd.Add(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eQ());
    int num;
    if (obj0.e() > 0)
    {
      List<string> fd = f2.fd;
      string str1 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eq();
      num = obj0.e();
      string str2 = num.ToString();
      string str3 = str1 + str2;
      fd.Add(str3);
    }
    if (obj0.G() > 0)
    {
      List<string> fd = f2.fd;
      string str4 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eR();
      num = obj0.G();
      string str5 = num.ToString();
      string str6 = str4 + str5;
      fd.Add(str6);
    }
    if (obj0.d() > 0)
    {
      List<string> fd = f2.fd;
      string str7 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.er();
      num = obj0.d();
      string str8 = num.ToString();
      string str9 = str7 + str8;
      fd.Add(str9);
    }
    if (obj0.E() > 0)
    {
      List<string> fd = f2.fd;
      string str10 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eS();
      num = obj0.E();
      string str11 = num.ToString();
      string str12 = str10 + str11;
      fd.Add(str12);
    }
    if (ds != null && ds.ef != l.WiperTier.None)
    {
      string str13;
      switch (ds.ef)
      {
        case l.WiperTier.Tier1:
          str13 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.es();
          break;
        case l.WiperTier.Tier2:
          str13 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eT();
          break;
        case l.WiperTier.Tier3:
          str13 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.et();
          break;
        default:
          str13 = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.m();
          break;
      }
      string str14 = str13;
      List<string> fd = f2.fd;
      DefaultInterpolatedStringHandler interpolatedStringHandler = new DefaultInterpolatedStringHandler(61, 4);
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eU());
      interpolatedStringHandler.AppendFormatted(str14);
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.b());
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eu());
      interpolatedStringHandler.AppendFormatted<int>(ds.ed);
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.eV());
      interpolatedStringHandler.AppendFormatted<int>(ds.eE);
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.ev());
      interpolatedStringHandler.AppendFormatted<int>(ds.ee);
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.DG());
      string stringAndClear = interpolatedStringHandler.ToStringAndClear();
      fd.Add(stringAndClear);
    }
    // ISSUE: reference to a compiler-generated field
    EventHandler<f> ch = this.CH;
    if (ch == null)
      return;
    ch((object) this, f2);
  }

  private static int? A([In] int obj0)
  {
    try
    {
      IntPtr num1 = G.A(G.ProcessAccessFlags.QueryInformation, false, obj0);
      if (num1 == IntPtr.Zero)
        return new int?();
      try
      {
        G.B b = new G.B();
        int num2 = 0;
        if (G.A(num1, 0, ref b, Marshal.SizeOf(typeof (G.B)), ref num2) == 0)
        {
          if (b.Ev != 0)
            return new int?(b.Ev);
        }
      }
      finally
      {
        G.A(num1);
      }
    }
    catch
    {
    }
    return new int?();
  }

  public void A()
  {
    // ISSUE: object of a compiler-generated type is created
    // ISSUE: variable of a compiler-generated type
    l.b b = new l.b();
    // ISSUE: reference to a compiler-generated field
    b.eH = this;
    lock (this.CE)
    {
      // ISSUE: reference to a compiler-generated field
      b.eh = DateTime.UtcNow;
      // ISSUE: reference to a compiler-generated method
      foreach (int num in Enumerable.ToList<int>(Enumerable.Select<KeyValuePair<int, g>, int>(Enumerable.Where<KeyValuePair<int, g>>((IEnumerable<KeyValuePair<int, g>>) this.Ce, new Func<KeyValuePair<int, g>, bool>(b.A)), (Func<KeyValuePair<int, g>, int>) (([In] obj0) => obj0.Key))))
      {
        this.Ce.Remove(num);
        this.CF.Remove(num);
      }
    }
  }

  private enum WiperTier
  {
    None,
    Tier1,
    Tier2,
    Tier3,
  }

  private sealed class a
  {
    public int ed;
    public int eE;
    public int ee;
    public DateTime eF;
    public l.WiperTier ef;
  }
}
