// Decompiled with JetBrains decompiler
// Type: A.a
// Assembly: RansomGuard, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 37652FF6-4FF5-4E76-944D-E6CA5073036F
// Assembly location: RansomGuard.dll inside C:\Users\WDAGUtilityAccount\Desktop\RansomGuard.exe)

using \u003CPrivateImplementationDetails\u003E\u007B29195D03\u002D3E0A\u002D468D\u002DA5D2\u002D1BA9D027086D\u007D;
using Microsoft.Diagnostics.Tracing;
using Microsoft.Diagnostics.Tracing.Parsers;
using Microsoft.Diagnostics.Tracing.Parsers.Kernel;
using Microsoft.Diagnostics.Tracing.Session;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Threading;
using System.Threading.Channels;
using System.Threading.Tasks;

#nullable enable
namespace A;

public sealed class a : IDisposable
{
  private const string M = "RansomGuardSession";
  private static readonly KernelTraceEventParser.Keywords m = KernelTraceEventParser.Keywords.Process | KernelTraceEventParser.Keywords.FileIO | KernelTraceEventParser.Keywords.FileIOInit;
  private readonly Channel<d> N;
  private readonly Channel<E> n;
  private readonly CancellationTokenSource O;
  private readonly Task o;
  private readonly object P = new object();
  private TraceEventSession? p;
  private Task? Q;
  private bool q;
  private readonly bool R;
  private const int r = 4096 /*0x1000*/;
  private readonly ConcurrentDictionary<int, A.a.A> S = new ConcurrentDictionary<int, A.a.A>();
  private readonly H s;
  private readonly Dictionary<(int pid, long fileObject), (string oldPath, DateTime timestampUtc)> T = new Dictionary<(int, long), (string, DateTime)>();

  public event EventHandler<d>? FileEvent;

  public event EventHandler<E>? FileRenameEvent;

  public a(bool _param1 = false)
  {
    this.R = _param1;
    this.s = new H();
    H.A(this.s);
    BoundedChannelOptions options1 = new BoundedChannelOptions(2048 /*0x0800*/);
    options1.SingleReader = true;
    options1.SingleWriter = false;
    options1.FullMode = BoundedChannelFullMode.DropOldest;
    this.N = Channel.CreateBounded<d>(options1);
    BoundedChannelOptions options2 = new BoundedChannelOptions(1024 /*0x0400*/);
    options2.SingleReader = true;
    options2.SingleWriter = false;
    options2.FullMode = BoundedChannelFullMode.DropOldest;
    this.n = Channel.CreateBounded<E>(options2);
    this.O = new CancellationTokenSource();
    this.o = Task.Run((Func<Task>) (() => this.A(this.O.Token)));
  }

  public void A()
  {
    lock (this.P)
    {
      if (this.q)
        throw new ObjectDisposedException(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.q());
      if (this.p != null)
        return;
      this.B();
      DefaultInterpolatedStringHandler interpolatedStringHandler = new DefaultInterpolatedStringHandler(2, 3);
      interpolatedStringHandler.AppendFormatted(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.R());
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.r());
      interpolatedStringHandler.AppendFormatted(Environment.MachineName);
      interpolatedStringHandler.AppendLiteral(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.r());
      interpolatedStringHandler.AppendFormatted<int>(Process.GetCurrentProcess().Id);
      string stringAndClear = interpolatedStringHandler.ToStringAndClear();
      A.a.A(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.R());
      A.a.A(stringAndClear);
      this.p = new TraceEventSession(stringAndClear, (string) null)
      {
        StopOnDispose = true
      };
      if (!TraceEventSession.IsElevated().GetValueOrDefault())
        throw new InvalidOperationException(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.S());
      int num = this.R ? 1 : 0;
      this.p.EnableKernelProvider(A.a.m);
      this.Q = Task.Run((Action) (() => this.A(this.p)));
    }
  }

  public void a()
  {
    lock (this.P)
    {
      if (this.q)
        return;
      this.O.Cancel();
      try
      {
        this.o.Wait(TimeSpan.FromSeconds(2.0));
      }
      catch
      {
      }
      try
      {
        this.Q?.Wait(TimeSpan.FromSeconds(2.0));
      }
      catch
      {
      }
      try
      {
        this.p?.Stop();
        this.p?.Dispose();
      }
      catch
      {
      }
      this.p = (TraceEventSession) null;
      try
      {
        A.a.A(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.R());
      }
      catch
      {
      }
    }
  }

  private void B()
  {
    if (TraceEventSession.IsElevated().GetValueOrDefault())
      return;
    string str = Process.GetCurrentProcess().MainModule?.FileName ?? throw new InvalidOperationException(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.s());
    ProcessStartInfo processStartInfo = new ProcessStartInfo()
    {
      FileName = str,
      UseShellExecute = true,
      Verb = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.T()
    };
    try
    {
      Process.Start(processStartInfo);
      Environment.Exit(0);
    }
    catch (Exception ex)
    {
      throw new InvalidOperationException(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.t(), ex);
    }
  }

  private static void A([In] string obj0)
  {
    try
    {
      List<string> activeSessionNames = TraceEventSession.GetActiveSessionNames();
      if (activeSessionNames == null)
        return;
      foreach (string sessionName in activeSessionNames)
      {
        if (sessionName.StartsWith(obj0, (StringComparison) 5))
        {
          try
          {
            using (TraceEventSession traceEventSession = new TraceEventSession(sessionName, (string) null))
              traceEventSession.Stop();
          }
          catch
          {
          }
          try
          {
            using (Process process = Process.Start(new ProcessStartInfo()
            {
              FileName = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.U(),
              Arguments = F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.u() + sessionName + F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.V(),
              UseShellExecute = false,
              CreateNoWindow = true,
              RedirectStandardOutput = true,
              RedirectStandardError = true
            }))
              process?.WaitForExit(2000);
          }
          catch
          {
          }
        }
      }
    }
    catch
    {
    }
  }

  private void A([In] TraceEventSession obj0)
  {
    try
    {
      obj0.Source.Kernel.ProcessStart += new Action<ProcessTraceData>(this.A);
      obj0.Source.Kernel.ProcessStop += new Action<ProcessTraceData>(this.a);
      obj0.Source.Kernel.FileIORead += new Action<FileIOReadWriteTraceData>(this.a);
      obj0.Source.Kernel.FileIOWrite += new Action<FileIOReadWriteTraceData>(this.a);
      obj0.Source.Kernel.FileIOCreate += new Action<FileIOCreateTraceData>(this.A);
      obj0.Source.Kernel.FileIORename += new Action<FileIOInfoTraceData>(this.A);
      obj0.Source.Kernel.FileIODelete += new Action<FileIOInfoTraceData>(this.a);
      obj0.Source.Kernel.FileIOFileDelete += new Action<FileIONameTraceData>(this.A);
      obj0.Source.Kernel.FileIOQueryInfo += new Action<FileIOInfoTraceData>(this.B);
      obj0.Source.Process();
    }
    catch (Exception ex)
    {
      int num = this.R ? 1 : 0;
    }
  }

  private void A([In] ProcessTraceData obj0)
  {
    try
    {
      if (obj0.ProcessID <= 0 || string.IsNullOrWhiteSpace(obj0.ImageFileName))
        return;
      A.a.A a = new A.a.A()
      {
        DN = A.a.a(obj0.ImageFileName),
        Dn = obj0.ProcessName
      };
      this.S[obj0.ProcessID] = a;
    }
    catch
    {
    }
  }

  private void a([In] ProcessTraceData obj0)
  {
    try
    {
      if (obj0.ProcessID <= 0)
        return;
      A.a.A a;
      this.S.TryRemove(obj0.ProcessID, ref a);
      this.s.B(obj0.ProcessID);
    }
    catch
    {
    }
  }

  private static string? a([In] string? obj0)
  {
    return string.IsNullOrWhiteSpace(obj0) ? (string) null : obj0.Trim();
  }

  private static string A([In] FileIOReadWriteTraceData obj0)
  {
    switch (obj0.Opcode)
    {
      case TraceEventOpcode.Stop | TraceEventOpcode.Suspend:
      case (TraceEventOpcode) 65:
        return F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.l();
      case TraceEventOpcode.DataCollectionStart | TraceEventOpcode.Suspend:
      case (TraceEventOpcode) 64 /*0x40*/:
      case (TraceEventOpcode) 68:
        return F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.j();
      case (TraceEventOpcode) 66:
        return F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.h();
      default:
        return F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.k();
    }
  }

  private void a([In] FileIOReadWriteTraceData obj0)
  {
    if (obj0.ProcessID <= 0 || string.IsNullOrWhiteSpace(obj0.FileName))
      return;
    (string ImagePath, string Name) tuple = this.A(obj0.ProcessID, obj0.ProcessName);
    if (string.IsNullOrWhiteSpace(tuple.ImagePath))
    {
      int num1 = this.R ? 1 : 0;
    }
    else
    {
      string str = (string) null;
      long fileObject = (long) obj0.FileObject;
      if (fileObject != 0L)
      {
        (int, long) valueTuple1 = (obj0.ProcessID, fileObject);
        lock (this.T)
        {
          (string, DateTime) valueTuple2;
          if (this.T.TryGetValue(valueTuple1, ref valueTuple2))
          {
            if (DateTime.op_Subtraction(DateTime.UtcNow, valueTuple2.Item2).TotalSeconds < 5.0)
              str = valueTuple2.Item1;
            this.T.Remove(valueTuple1);
          }
        }
      }
      if (!string.IsNullOrEmpty(str))
      {
        E e = new E();
        e.A(obj0.ProcessID);
        e.fA = tuple.Name;
        e.fa = tuple.ImagePath;
        e.A(str);
        e.a(obj0.FileName);
        this.n.Writer.TryWrite(e);
        int num2 = this.R ? 1 : 0;
      }
      d d = new d();
      d.A(obj0.ProcessID);
      d.FZ = tuple.Name;
      d.Fz = tuple.ImagePath;
      d.a(obj0.FileName);
      d.b(A.a.A(obj0));
      d.A(DateTime.UtcNow);
      this.N.Writer.TryWrite(d);
    }
  }

  private void A([In] FileIOCreateTraceData obj0)
  {
    if (obj0.ProcessID <= 0 || string.IsNullOrWhiteSpace(obj0.FileName))
      return;
    (string ImagePath, string Name) tuple = this.A(obj0.ProcessID, obj0.ProcessName);
    if (string.IsNullOrWhiteSpace(tuple.ImagePath))
    {
      int num1 = this.R ? 1 : 0;
    }
    else
    {
      string str1 = (string) null;
      long fileObject = (long) obj0.FileObject;
      if (fileObject != 0L)
      {
        (int, long) valueTuple1 = (obj0.ProcessID, fileObject);
        lock (this.T)
        {
          (string, DateTime) valueTuple2;
          if (this.T.TryGetValue(valueTuple1, ref valueTuple2))
          {
            if (DateTime.op_Subtraction(DateTime.UtcNow, valueTuple2.Item2).TotalSeconds < 5.0)
              str1 = valueTuple2.Item1;
            this.T.Remove(valueTuple1);
          }
        }
      }
      if (!string.IsNullOrEmpty(str1))
      {
        E e = new E();
        e.A(obj0.ProcessID);
        e.fA = tuple.Name;
        e.fa = tuple.ImagePath;
        e.A(str1);
        e.a(obj0.FileName);
        this.n.Writer.TryWrite(e);
        int num2 = this.R ? 1 : 0;
      }
      bool flag = false;
      try
      {
        flag = (obj0.CreateOptions & CreateOptions.FILE_ATTRIBUTE_OFFLINE) != 0;
      }
      catch
      {
      }
      string str2 = flag ? F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.I() : F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.K();
      int num3 = this.R & flag ? 1 : 0;
      d d = new d();
      d.A(obj0.ProcessID);
      d.FZ = tuple.Name;
      d.Fz = tuple.ImagePath;
      d.a(obj0.FileName);
      d.b(str2);
      d.A(DateTime.UtcNow);
      this.N.Writer.TryWrite(d);
    }
  }

  private void A([In] FileIOInfoTraceData obj0)
  {
    if (obj0.ProcessID <= 0 || string.IsNullOrWhiteSpace(obj0.FileName))
      return;
    long fileObject = (long) obj0.FileObject;
    if (fileObject == 0L)
    {
      int num1 = this.R ? 1 : 0;
    }
    else
    {
      (int, long) valueTuple = (obj0.ProcessID, fileObject);
      lock (this.T)
        this.T[valueTuple] = (obj0.FileName, DateTime.UtcNow);
      int num2 = this.R ? 1 : 0;
    }
  }

  private void a([In] FileIOInfoTraceData obj0)
  {
    if (obj0.ProcessID <= 0 || string.IsNullOrWhiteSpace(obj0.FileName))
      return;
    (string ImagePath, string Name) tuple = this.A(obj0.ProcessID, obj0.ProcessName);
    if (string.IsNullOrWhiteSpace(tuple.ImagePath))
    {
      int num1 = this.R ? 1 : 0;
    }
    else
    {
      d d = new d();
      d.A(obj0.ProcessID);
      d.FZ = tuple.Name;
      d.Fz = tuple.ImagePath;
      d.a(obj0.FileName);
      d.b(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.h());
      d.A(DateTime.UtcNow);
      this.N.Writer.TryWrite(d);
      int num2 = this.R ? 1 : 0;
    }
  }

  private void A([In] FileIONameTraceData obj0)
  {
    if (obj0.ProcessID <= 0 || string.IsNullOrWhiteSpace(obj0.FileName))
      return;
    (string ImagePath, string Name) tuple = this.A(obj0.ProcessID, obj0.ProcessName);
    if (string.IsNullOrWhiteSpace(tuple.ImagePath))
    {
      int num1 = this.R ? 1 : 0;
    }
    else
    {
      d d = new d();
      d.A(obj0.ProcessID);
      d.FZ = tuple.Name;
      d.Fz = tuple.ImagePath;
      d.a(obj0.FileName);
      d.b(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.h());
      d.A(DateTime.UtcNow);
      this.N.Writer.TryWrite(d);
      int num2 = this.R ? 1 : 0;
    }
  }

  private void B([In] FileIOInfoTraceData obj0)
  {
    if (obj0.ProcessID <= 0)
      return;
    if (string.IsNullOrWhiteSpace(obj0.FileName))
      return;
    try
    {
      if (obj0.InfoClass != 13)
        return;
      if (obj0.ExtraInfo != 1UL)
        return;
    }
    catch
    {
      return;
    }
    (string ImagePath, string Name) tuple = this.A(obj0.ProcessID, obj0.ProcessName);
    if (string.IsNullOrWhiteSpace(tuple.ImagePath))
    {
      int num1 = this.R ? 1 : 0;
    }
    else
    {
      d d = new d();
      d.A(obj0.ProcessID);
      d.FZ = tuple.Name;
      d.Fz = tuple.ImagePath;
      d.a(obj0.FileName);
      d.b(F5D1BF18\u002D5FBA\u002D43C1\u002DA4E0\u002D6D909C027158.I());
      d.A(DateTime.UtcNow);
      this.N.Writer.TryWrite(d);
      int num2 = this.R ? 1 : 0;
    }
  }

  private async Task A([In] CancellationToken obj0)
  {
    A.a a = this;
    ChannelReader<d> channelReader1 = a.N.Reader;
    ChannelReader<E> channelReader2 = a.n.Reader;
    while (!obj0.IsCancellationRequested)
    {
      try
      {
        ValueTask<bool> readAsync = channelReader1.WaitToReadAsync(obj0);
        Task<bool> task1 = readAsync.AsTask();
        readAsync = channelReader2.WaitToReadAsync(obj0);
        Task<bool> task2 = readAsync.AsTask();
        Task<bool> task = await Task.WhenAny<bool>(task1, task2).ConfigureAwait(false);
        if (!((Task) task).IsCanceled)
        {
          if (!((Task) task).IsFaulted)
          {
            if (((Task) task1).IsCompletedSuccessfully && task1.Result)
            {
              d d;
              while (channelReader1.TryRead(out d))
              {
                // ISSUE: reference to a compiler-generated field
                EventHandler<d> t = a.t;
                if (t != null)
                  t((object) a, d);
              }
            }
            if (((Task) task2).IsCompletedSuccessfully && task2.Result)
            {
              E e;
              while (channelReader2.TryRead(out e))
              {
                // ISSUE: reference to a compiler-generated field
                EventHandler<E> u = a.U;
                if (u != null)
                  u((object) a, e);
              }
            }
            task1 = (Task<bool>) null;
            task2 = (Task<bool>) null;
          }
          else
            continue;
        }
        else
          continue;
      }
      catch (OperationCanceledException ex)
      {
        channelReader1 = (ChannelReader<d>) null;
        channelReader2 = (ChannelReader<E>) null;
        return;
      }
      catch (Exception ex1)
      {
        int num = a.R ? 1 : 0;
        try
        {
          await Task.Delay(100, obj0).ConfigureAwait(false);
        }
        catch (OperationCanceledException ex2)
        {
          channelReader1 = (ChannelReader<d>) null;
          channelReader2 = (ChannelReader<E>) null;
          return;
        }
      }
    }
    channelReader1 = (ChannelReader<d>) null;
    channelReader2 = (ChannelReader<E>) null;
  }

  private (string? ImagePath, string? Name) A([In] int obj0, [In] string? obj1)
  {
    A.a.A a;
    if (this.S.TryGetValue(obj0, ref a))
    {
      string str = !string.IsNullOrWhiteSpace(a.Dn) ? a.Dn : obj1;
      return (a.DN, str);
    }
    F f = H.a(obj0);
    return f == null ? ((string) null, obj1) : (f.B(), f.a() ?? obj1);
  }

  public void b() => this.s.A();

  public void Dispose()
  {
    if (this.q)
      return;
    this.q = true;
    try
    {
      this.a();
    }
    catch
    {
    }
    try
    {
      this.O.Cancel();
    }
    catch
    {
    }
    try
    {
      this.O.Dispose();
    }
    catch
    {
    }
  }

  private sealed class A
  {
    public string? DN;
    public string? Dn;
  }
}
