// Decompiled with JetBrains decompiler
// Type: A.B
// Assembly: RansomGuard, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 37652FF6-4FF5-4E76-944D-E6CA5073036F
// Assembly location: RansomGuard.dll inside C:\Users\WDAGUtilityAccount\Desktop\RansomGuard.exe)

using \u003CPrivateImplementationDetails\u003E\u007B29195D03\u002D3E0A\u002D468D\u002DA5D2\u002D1BA9D027086D\u007D;
using System;
using System.Buffers;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.InteropServices.ComTypes;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;

#nullable enable
namespace A;

internal static class B
{
  private const uint u = 2;
  private const uint V = 0;
  private const uint v = 1;
  private const uint W = 2;
  private const uint w = 2;
  private static readonly Guid X = new Guid(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.W());
  private static readonly Guid x = new Guid(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.w());
  private const uint Y = 1;
  private const uint y = 4;
  private const uint Z = 2147483648 /*0x80000000*/;
  private const uint z = 1;
  private const uint aA = 3;
  private static readonly IntPtr aa = new IntPtr(-1);
  private static readonly ConcurrentDictionary<A.B.D, A.B.d> aB = new ConcurrentDictionary<A.B.D, A.B.d>();
  private static readonly ThreadLocal<StringBuilder> ab = new ThreadLocal<StringBuilder>((Func<StringBuilder>) (() => new StringBuilder(256 /*0x0100*/)));
  private const string aC = "Microsoft";

  [DllImport("wintrust.dll", EntryPoint = "WinVerifyTrust", CharSet = (CharSet) 3, SetLastError = true)]
  private static extern int A([In] IntPtr obj0, [In] ref Guid obj1, [In] ref A.B.a obj2);

  [DllImport("wintrust.dll", EntryPoint = "WTHelperProvDataFromStateData", SetLastError = true)]
  private static extern IntPtr A([In] IntPtr obj0);

  [DllImport("wintrust.dll", EntryPoint = "WTHelperGetProvSignerFromChain", SetLastError = true)]
  private static extern IntPtr A([In] IntPtr obj0, [In] uint obj1, [In] bool obj2, [In] uint obj3);

  [DllImport("wintrust.dll", EntryPoint = "WTHelperGetProvCertFromChain", SetLastError = true)]
  private static extern IntPtr A([In] IntPtr obj0, [In] uint obj1);

  [DllImport("crypt32.dll", EntryPoint = "CertGetNameString", CharSet = (CharSet) 4, SetLastError = true)]
  private static extern bool A(
    [In] IntPtr obj0,
    [In] uint obj1,
    [In] uint obj2,
    [In] IntPtr obj3,
    [In] StringBuilder obj4,
    [In] uint obj5);

  [DllImport("wintrust.dll", EntryPoint = "CryptCATAdminAcquireContext", CharSet = (CharSet) 3, SetLastError = true)]
  private static extern bool A(out IntPtr _param0, [In] IntPtr obj1, [In] uint obj2);

  [DllImport("wintrust.dll", EntryPoint = "CryptCATAdminReleaseContext", SetLastError = true)]
  private static extern bool a([In] IntPtr obj0, [In] uint obj1);

  [DllImport("wintrust.dll", EntryPoint = "CryptCATAdminEnumCatalogFromHash", CharSet = (CharSet) 3, SetLastError = true)]
  private static extern IntPtr A([In] IntPtr obj0, [In] IntPtr obj1, [In] uint obj2, [In] uint obj3, [In] ref IntPtr obj4);

  [DllImport("wintrust.dll", EntryPoint = "CryptCATCatalogInfoFromContext", CharSet = (CharSet) 3, SetLastError = true)]
  private static extern bool A([In] IntPtr obj0, out A.B.B _param1, [In] uint obj2);

  [DllImport("wintrust.dll", EntryPoint = "CryptCATAdminReleaseCatalogContext", SetLastError = true)]
  private static extern bool A([In] IntPtr obj0, [In] IntPtr obj1, [In] uint obj2);

  [DllImport("wintrust.dll", EntryPoint = "CryptCATAdminCalcHashFromFileHandle", CharSet = (CharSet) 3, SetLastError = true)]
  private static extern bool A([In] IntPtr obj0, [In] ref uint obj1, [In] IntPtr obj2, [In] uint obj3);

  [DllImport("kernel32.dll", EntryPoint = "CreateFile", CharSet = (CharSet) 3, SetLastError = true)]
  private static extern IntPtr A(
    [In] string obj0,
    [In] uint obj1,
    [In] uint obj2,
    [In] IntPtr obj3,
    [In] uint obj4,
    [In] uint obj5,
    [In] IntPtr obj6);

  [DllImport("kernel32.dll", EntryPoint = "CloseHandle", SetLastError = true)]
  private static extern bool a([In] IntPtr obj0);

  [MethodImpl((MethodImplOptions) 512)]
  public static bool A([In] string obj0, bool _param1 = false)
  {
    // ISSUE: object of a compiler-generated type is created
    // ISSUE: variable of a compiler-generated type
    A.B.e e = new A.B.e();
    // ISSUE: reference to a compiler-generated field
    e.EH = _param1;
    if (!string.IsNullOrEmpty(obj0))
    {
      if (File.Exists(obj0))
      {
        try
        {
          X509Certificate.CreateFromSignedFile(obj0);
          return false;
        }
        catch
        {
        }
        long length = new FileInfo(obj0).Length;
        // ISSUE: reference to a compiler-generated field
        // ISSUE: reference to a compiler-generated field
        // ISSUE: reference to a compiler-generated field
        // ISSUE: method pointer
        string path = string.Create<string>(obj0.Length, obj0, A.B.E.Eg ?? (A.B.E.Eg = new SpanAction<char, string>((object) A.B.E.EG, __methodptr(A))));
        Span<byte> span = stackalloc byte[64 /*0x40*/];
        int num = A.B.A(obj0, span);
        if (num == 0)
          return false;
        ReadOnlySpan<byte> readOnlySpan = Span<byte>.op_Implicit(span.Slice(0, num));
        A.B.D d1 = new A.B.D(path, length, readOnlySpan);
        A.B.d d2;
        if (A.B.aB.TryGetValue(d1, ref d2))
        {
          // ISSUE: reference to a compiler-generated field
          if (e.EH)
          {
            if (d2.B().HasValue)
              return d2.B().Value;
          }
          else if (d2.a().HasValue)
            return d2.a().Value;
        }
        byte[] array = readOnlySpan.ToArray();
        // ISSUE: reference to a compiler-generated field
        // ISSUE: reference to a compiler-generated field
        e.Eh = A.B.A(obj0, e.EH, array);
        // ISSUE: reference to a compiler-generated method
        // ISSUE: reference to a compiler-generated method
        A.B.aB.AddOrUpdate(d1, new Func<A.B.D, A.B.d>(e.A), new Func<A.B.D, A.B.d, A.B.d>(e.A));
        // ISSUE: reference to a compiler-generated field
        return e.Eh;
      }
    }
    return false;
  }

  [MethodImpl((MethodImplOptions) 512)]
  private static bool A([In] string obj0, [In] bool obj1, [In] byte[] obj2)
  {
    ReadOnlySpan<Guid> readOnlySpan = Span<Guid>.op_Implicit(stackalloc Guid[2]
    {
      A.B.x,
      Guid.Empty
    });
    for (int index = 0; index < readOnlySpan.Length; ++index)
    {
      Guid guid = readOnlySpan[index];
      IntPtr num1 = IntPtr.Zero;
      IntPtr zero1 = IntPtr.Zero;
      IntPtr num2 = IntPtr.Zero;
      GCHandle gcHandle = new GCHandle();
      try
      {
        if (Guid.op_Inequality(guid, Guid.Empty))
        {
          num1 = Marshal.AllocHGlobal(Marshal.SizeOf<Guid>());
          Marshal.StructureToPtr<Guid>(guid, num1, false);
        }
        if (A.B.A(out zero1, num1, 0U))
        {
          gcHandle = GCHandle.Alloc((object) obj2, (GCHandleType) 3);
          IntPtr zero2 = IntPtr.Zero;
          num2 = A.B.A(zero1, gcHandle.AddrOfPinnedObject(), (uint) obj2.Length, 0U, ref zero2);
          if (num2 != IntPtr.Zero)
          {
            A.B.B b;
            if (A.B.A(num2, out b, 0U))
            {
              if (!string.IsNullOrEmpty(b.df))
              {
                if (A.B.A(b.df, obj0, obj2, zero1, obj1))
                  return true;
              }
            }
          }
        }
      }
      finally
      {
        if (gcHandle.IsAllocated)
          gcHandle.Free();
        if (num2 != IntPtr.Zero)
        {
          A.B.A(zero1, num2, 0U);
          IntPtr zero3 = IntPtr.Zero;
        }
        if (zero1 != IntPtr.Zero)
        {
          A.B.a(zero1, 0U);
          IntPtr zero4 = IntPtr.Zero;
        }
        if (num1 != IntPtr.Zero)
        {
          Marshal.FreeHGlobal(num1);
          IntPtr zero5 = IntPtr.Zero;
        }
      }
    }
    return false;
  }

  [MethodImpl((MethodImplOptions) 512)]
  private static bool A([In] string obj0, [In] string obj1, [In] byte[] obj2, [In] IntPtr obj3, [In] bool obj4)
  {
    if (obj2 == null)
      return false;
    GCHandle gcHandle = GCHandle.Alloc((object) obj2, (GCHandleType) 3);
    IntPtr num1 = IntPtr.Zero;
    IntPtr num2 = IntPtr.Zero;
    IntPtr num3 = IntPtr.Zero;
    IntPtr num4 = IntPtr.Zero;
    A.B.a a1 = new A.B.a();
    try
    {
      num1 = Marshal.StringToHGlobalUni(obj0);
      char[] chArray = ArrayPool<char>.Shared.Rent(obj2.Length * 2);
      try
      {
        for (int index = 0; index < obj2.Length; ++index)
        {
          byte num5 = obj2[index];
          chArray[index * 2] = A.B.A((int) num5 >> 4);
          chArray[index * 2 + 1] = A.B.A((int) num5 & 15);
        }
        num2 = Marshal.StringToHGlobalUni(new string(chArray, 0, obj2.Length * 2));
      }
      finally
      {
        ArrayPool<char>.Shared.Return(chArray, false);
      }
      num3 = Marshal.StringToHGlobalUni(obj1);
      num4 = Marshal.AllocHGlobal(Marshal.SizeOf<A.B.A>());
      Marshal.StructureToPtr<A.B.A>(new A.B.A()
      {
        DU = (uint) Marshal.SizeOf<A.B.A>(),
        DV = num1,
        Dv = num2,
        DW = num3,
        DX = gcHandle.AddrOfPinnedObject(),
        Dx = (uint) obj2.Length,
        Dy = obj3
      }, num4, false);
      a1 = new A.B.a()
      {
        DZ = (uint) Marshal.SizeOf<A.B.a>(),
        da = 2U,
        dB = 0U,
        db = 2U,
        dC = num4,
        dc = 1U
      };
      Guid x = A.B.X;
      if (A.B.A(IntPtr.Zero, ref x, ref a1) != 0)
        return false;
      return !obj4 || A.B.B(a1.dD);
    }
    finally
    {
      if (gcHandle.IsAllocated)
        gcHandle.Free();
      if (num1 != IntPtr.Zero)
        Marshal.FreeHGlobal(num1);
      if (num2 != IntPtr.Zero)
        Marshal.FreeHGlobal(num2);
      if (num3 != IntPtr.Zero)
        Marshal.FreeHGlobal(num3);
      if (num4 != IntPtr.Zero)
        Marshal.FreeHGlobal(num4);
      if (a1.dD != IntPtr.Zero)
      {
        A.B.a a2 = new A.B.a()
        {
          DZ = (uint) Marshal.SizeOf<A.B.a>(),
          dc = 2,
          dD = a1.dD
        };
        Guid x = A.B.X;
        A.B.A(IntPtr.Zero, ref x, ref a2);
      }
    }
  }

  [MethodImpl((MethodImplOptions) 256)]
  private static char A([In] int obj0)
  {
    return obj0 < 10 ? (char) (48 /*0x30*/ + obj0) : (char) (65 + obj0 - 10);
  }

  [MethodImpl((MethodImplOptions) 512)]
  private static bool B([In] IntPtr obj0)
  {
    if (obj0 == IntPtr.Zero)
      return false;
    IntPtr num1 = A.B.A(obj0);
    if (num1 == IntPtr.Zero)
      return false;
    try
    {
      if (Marshal.PtrToStructure<A.B.b>(num1).dO == 0U)
        return false;
      IntPtr num2 = A.B.A(num1, 0U, false, 0U);
      if (num2 == IntPtr.Zero)
        return false;
      IntPtr num3 = A.B.A(num2, 0U);
      if (num3 == IntPtr.Zero)
        return false;
      A.B.c structure = Marshal.PtrToStructure<A.B.c>(num3);
      if (structure.dX == IntPtr.Zero)
        return false;
      StringBuilder stringBuilder = A.B.ab.Value;
      stringBuilder.Clear();
      if (A.B.A(structure.dX, 4U, 0U, IntPtr.Zero, stringBuilder, 256U /*0x0100*/) && stringBuilder.ToString().Contains(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.v(), (StringComparison) 5))
        return true;
      stringBuilder.Clear();
      return A.B.A(structure.dX, 4U, 1U, IntPtr.Zero, stringBuilder, 256U /*0x0100*/) && stringBuilder.ToString().Contains(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.v(), (StringComparison) 5);
    }
    catch
    {
      return false;
    }
  }

  [MethodImpl((MethodImplOptions) 512)]
  private static int A(string filePath, [In] Span<byte> obj1)
  {
    IntPtr num = A.B.A(filePath, 2147483648U /*0x80000000*/, 1U, IntPtr.Zero, 3U, 0U, IntPtr.Zero);
    bool flag = num != IntPtr.Zero && num != A.B.aa;
    if (!flag)
      return 0;
    try
    {
      uint length = 0;
      if (!A.B.A(num, ref length, IntPtr.Zero, 0U) || length == 0U || (long) length > (long) obj1.Length)
        return 0;
      byte[] array = obj1.ToArray();
      GCHandle gcHandle = GCHandle.Alloc((object) array, (GCHandleType) 3);
      try
      {
        if (!A.B.A(num, ref length, gcHandle.AddrOfPinnedObject(), 0U))
          return 0;
        array.AsSpan<byte>(0, (int) length).CopyTo(obj1);
        return (int) length;
      }
      finally
      {
        if (gcHandle.IsAllocated)
          gcHandle.Free();
      }
    }
    finally
    {
      if (flag)
        A.B.a(num);
    }
  }

  [StructLayout((LayoutKind) 0, CharSet = (CharSet) 3)]
  private struct A
  {
    internal uint DU;
    internal uint Du;
    internal IntPtr DV;
    internal IntPtr Dv;
    internal IntPtr DW;
    internal IntPtr Dw;
    internal IntPtr DX;
    internal uint Dx;
    internal IntPtr DY;
    internal IntPtr Dy;
  }

  [StructLayout((LayoutKind) 0, CharSet = (CharSet) 3)]
  private struct a
  {
    internal uint DZ;
    internal IntPtr Dz;
    internal IntPtr dA;
    internal uint da;
    internal uint dB;
    internal uint db;
    internal IntPtr dC;
    internal uint dc;
    internal IntPtr dD;
    internal IntPtr dd;
    internal uint dE;
    internal uint de;
  }

  [StructLayout((LayoutKind) 0, CharSet = (CharSet) 3)]
  private struct B
  {
    internal uint dF;
    [MarshalAs((UnmanagedType) 23, SizeConst = 260)]
    internal string df;
  }

  private struct b
  {
    internal uint dG;
    internal IntPtr dg;
    internal bool dH;
    internal IntPtr dh;
    internal IntPtr dI;
    internal IntPtr di;
    internal uint dJ;
    internal uint dj;
    internal uint dK;
    internal IntPtr dk;
    internal uint dL;
    internal IntPtr dl;
    internal uint dM;
    internal IntPtr dm;
    internal uint dN;
    internal IntPtr dn;
    internal uint dO;
    internal IntPtr @do;
    internal uint dP;
    internal IntPtr dp;
    internal uint dQ;
    internal IntPtr dq;
  }

  private struct C
  {
    internal uint dR;
    internal FILETIME dr;
    internal uint dS;
    internal IntPtr ds;
    internal uint dT;
    internal IntPtr dt;
    internal uint dU;
    internal uint du;
    internal IntPtr dV;
    internal IntPtr dv;
    internal IntPtr dW;
  }

  private struct c
  {
    internal uint dw;
    internal IntPtr dX;
    internal bool dx;
    internal bool dY;
    internal bool dy;
    internal bool dZ;
    internal uint dz;
    internal uint EA;
    internal uint Ea;
    internal IntPtr EB;
    internal bool Eb;
    internal IntPtr EC;
    internal uint Ec;
    internal bool ED;
  }

  private readonly struct D : IEquatable<A.B.D>
  {
    private readonly string Ed;
    private readonly long EE;
    private readonly int Ee;

    public D(string path, [In] long obj1, [In] ReadOnlySpan<byte> obj2)
    {
      this.Ed = path;
      this.EE = obj1;
      int num1 = (17 * 31 /*0x1F*/ + path.GetHashCode()) * 31 /*0x1F*/ + obj1.GetHashCode();
      int num2 = Math.Min(obj2.Length, 16 /*0x10*/);
      for (int index = 0; index < num2; ++index)
        num1 = num1 * 31 /*0x1F*/ + (int) obj2[index];
      this.Ee = num1;
    }

    [MethodImpl((MethodImplOptions) 256)]
    public bool Equals([In] A.B.D obj0)
    {
      return this.Ee == obj0.Ee && this.EE == obj0.EE && string.op_Equality(this.Ed, obj0.Ed);
    }

    public virtual bool Equals([In] object? obj0) => obj0 is A.B.D d && this.Equals(d);

    public virtual int GetHashCode() => this.Ee;
  }

  private sealed class d : IEquatable<
  #nullable disable
  A.B.d>
  {
    public d([In] bool? obj0, [In] bool? obj1)
    {
      // ISSUE: reference to a compiler-generated field
      this.EF = obj0;
      // ISSUE: reference to a compiler-generated field
      this.Ef = obj1;
      // ISSUE: explicit constructor call
      base.\u002Ector();
    }

    [CompilerGenerated]
    private 
    #nullable enable
    Type fh => typeof (A.B.d);

    [CompilerGenerated]
    [SpecialName]
    public bool? a() => this.EF;

    [CompilerGenerated]
    [SpecialName]
    public void A([In] bool? obj0) => this.EF = obj0;

    [CompilerGenerated]
    [SpecialName]
    public bool? B() => this.Ef;

    [CompilerGenerated]
    [SpecialName]
    public void a([In] bool? obj0) => this.Ef = obj0;

    public A.B.d A([In] bool obj0)
    {
      A.B.d d = this.a();
      d.A(new bool?(obj0));
      return d;
    }

    public A.B.d a([In] bool obj0)
    {
      A.B.d d = this.a();
      d.a(new bool?(obj0));
      return d;
    }

    [CompilerGenerated]
    public virtual string ToString()
    {
      StringBuilder stringBuilder = new StringBuilder();
      stringBuilder.Append(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.gU());
      stringBuilder.Append(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.gu());
      // ISSUE: reference to a compiler-generated method
      if (this.A(stringBuilder))
        stringBuilder.Append(' ');
      stringBuilder.Append('}');
      return stringBuilder.ToString();
    }

    [CompilerGenerated]
    public static bool operator !=([In] A.B.d? obj0, [In] A.B.d? obj1) => !(obj0 == obj1);

    [CompilerGenerated]
    public static bool operator ==([In] A.B.d? obj0, [In] A.B.d? obj1)
    {
      if ((object) obj0 == (object) obj1)
        return true;
      return (object) obj0 != null && obj0.Equals(obj1);
    }

    [CompilerGenerated]
    public virtual int GetHashCode()
    {
      // ISSUE: reference to a compiler-generated field
      // ISSUE: reference to a compiler-generated field
      return (EqualityComparer<Type>.Default.GetHashCode(this.fh) * -1521134295 + EqualityComparer<bool?>.Default.GetHashCode(this.EF)) * -1521134295 + EqualityComparer<bool?>.Default.GetHashCode(this.Ef);
    }

    [CompilerGenerated]
    public virtual bool Equals([In] object? obj0) => this.Equals(obj0 as A.B.d);

    [CompilerGenerated]
    public bool Equals([In] A.B.d? obj0)
    {
      if ((object) this == (object) obj0)
        return true;
      // ISSUE: reference to a compiler-generated field
      // ISSUE: reference to a compiler-generated field
      // ISSUE: reference to a compiler-generated field
      // ISSUE: reference to a compiler-generated field
      return (object) obj0 != null && Type.op_Equality(this.fh, obj0.fh) && EqualityComparer<bool?>.Default.Equals(this.EF, obj0.EF) && EqualityComparer<bool?>.Default.Equals(this.Ef, obj0.Ef);
    }

    [CompilerGenerated]
    public A.B.d a() => new A.B.d(this);

    [CompilerGenerated]
    public void A(out bool? _param1, out bool? _param2)
    {
      _param1 = this.a();
      _param2 = this.B();
    }
  }
}
