// Decompiled with JetBrains decompiler // Type: Refx.modRC4 // Assembly: Refx, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 5DD4C44F-C748-4813-B398-D3DE520CF41A // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.bezr-e553a7902dd2b2c973a97028cc8dc7f1bb82c18b1266abf90d2140ec0b5b3a01.exe using Microsoft.VisualBasic; using Microsoft.VisualBasic.CompilerServices; using System; using System.Text; using System.Threading; namespace Refx { [StandardModule] internal sealed class modRC4 { public static string rc4(string message, string password) { int index1 = 0; int index2 = 0; StringBuilder stringBuilder = new StringBuilder(); string empty = string.Empty; int[] numArray1 = new int[257]; int[] numArray2 = new int[257]; int length = password.Length; int location1 = 0; while (location1 <= (int) byte.MaxValue) { char String = password.Substring(location1 % length, 1).ToCharArray()[0]; numArray2[location1] = Strings.Asc(String); numArray1[location1] = location1; Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1)); } int index3 = 0; int location2 = 0; while (location2 <= (int) byte.MaxValue) { index3 = checked (index3 + numArray1[location2] + numArray2[location2]) % 256; int num = numArray1[location2]; numArray1[location2] = numArray1[index3]; numArray1[index3] = num; Math.Max(Interlocked.Increment(ref location2), checked (location2 - 1)); } location1 = 1; while (location1 <= message.Length) { index1 = checked (index1 + 1) % 256; index2 = checked (index2 + numArray1[index1]) % 256; int num1 = numArray1[index1]; numArray1[index1] = numArray1[index2]; numArray1[index2] = num1; int num2 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256]; int CharCode = Strings.Asc(message.Substring(checked (location1 - 1), 1).ToCharArray()[0]) ^ num2; stringBuilder.Append(Strings.Chr(CharCode)); Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1)); } string str = stringBuilder.ToString(); stringBuilder.Length = 0; return str; } } }