mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-20 00:58:52 +00:00
51 lines
2.2 KiB
C#
51 lines
2.2 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062
|
||
// MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe
|
||
|
||
using System;
|
||
using System.IO;
|
||
using System.Reflection;
|
||
using System.Runtime.InteropServices;
|
||
using System.Text;
|
||
|
||
namespace \u0001
|
||
{
|
||
internal sealed class \u0001
|
||
{
|
||
private static Stream \u0001;
|
||
private static int \u0001 = 0;
|
||
|
||
public static string \u0003([In] int obj0)
|
||
{
|
||
byte[] numArray;
|
||
lock (typeof (\u0001.\u0001))
|
||
{
|
||
if (\u0001.\u0001.\u0001 == null)
|
||
{
|
||
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
||
\u0001.\u0001.\u0001 = executingAssembly.GetManifestResourceStream(executingAssembly.ManifestModule.ModuleVersionId.ToString("B"));
|
||
byte[] publicKeyToken = executingAssembly.GetName().GetPublicKeyToken();
|
||
if (publicKeyToken != null)
|
||
{
|
||
for (int index = 0; index < publicKeyToken.Length - 1; index += 2)
|
||
\u0001.\u0001.\u0001 ^= ((int) publicKeyToken[index] << 8) + (int) publicKeyToken[index + 1];
|
||
}
|
||
int num = ((MethodBase.GetCurrentMethod().MetadataToken & 16777215) - 1) % (int) ushort.MaxValue;
|
||
\u0001.\u0001.\u0001 ^= num;
|
||
}
|
||
\u0001.\u0001.\u0001.Position = (long) (obj0 - \u0001.\u0001.\u0001);
|
||
int num1 = \u0001.\u0001.\u0001.ReadByte();
|
||
int count = (num1 & 128) != 0 ? ((num1 & 64) != 0 ? ((num1 & 31) << 24) + (\u0001.\u0001.\u0001.ReadByte() << 16) + (\u0001.\u0001.\u0001.ReadByte() << 8) + \u0001.\u0001.\u0001.ReadByte() : ((num1 & 63) << 8) + \u0001.\u0001.\u0001.ReadByte()) : num1;
|
||
numArray = new byte[count];
|
||
\u0001.\u0001.\u0001.Read(numArray, 0, count);
|
||
}
|
||
if (numArray.Length == 0)
|
||
return string.Empty;
|
||
byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(numArray, 0, numArray.Length));
|
||
return string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
|
||
}
|
||
}
|
||
}
|