// Decompiled with JetBrains decompiler // Type: . // Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062 // MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe using System; using System.IO; using System.Reflection; using System.Runtime.InteropServices; using System.Text; namespace \u0001 { internal sealed class \u0001 { private static Stream \u0001; private static int \u0001 = 0; public static string \u0003([In] int obj0) { byte[] numArray; lock (typeof (\u0001.\u0001)) { if (\u0001.\u0001.\u0001 == null) { Assembly executingAssembly = Assembly.GetExecutingAssembly(); \u0001.\u0001.\u0001 = executingAssembly.GetManifestResourceStream(executingAssembly.ManifestModule.ModuleVersionId.ToString("B")); byte[] publicKeyToken = executingAssembly.GetName().GetPublicKeyToken(); if (publicKeyToken != null) { for (int index = 0; index < publicKeyToken.Length - 1; index += 2) \u0001.\u0001.\u0001 ^= ((int) publicKeyToken[index] << 8) + (int) publicKeyToken[index + 1]; } int num = ((MethodBase.GetCurrentMethod().MetadataToken & 16777215) - 1) % (int) ushort.MaxValue; \u0001.\u0001.\u0001 ^= num; } \u0001.\u0001.\u0001.Position = (long) (obj0 - \u0001.\u0001.\u0001); int num1 = \u0001.\u0001.\u0001.ReadByte(); int count = (num1 & 128) != 0 ? ((num1 & 64) != 0 ? ((num1 & 31) << 24) + (\u0001.\u0001.\u0001.ReadByte() << 16) + (\u0001.\u0001.\u0001.ReadByte() << 8) + \u0001.\u0001.\u0001.ReadByte() : ((num1 & 63) << 8) + \u0001.\u0001.\u0001.ReadByte()) : num1; numArray = new byte[count]; \u0001.\u0001.\u0001.Read(numArray, 0, count); } if (numArray.Length == 0) return string.Empty; byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(numArray, 0, numArray.Length)); return string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length)); } } }