auto-decompiled msil via petikvx

add

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/AssemblyInfo.cs

@@ -0,0 +1,15 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security.Permissions;
+
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCopyright("")]
+[assembly: AssemblyProduct("")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyTitle("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Buffer/InBuffer.cs

@@ -0,0 +1,63 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Buffer.InBuffer
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Buffer
+{
+  public class InBuffer
+  {
+    private byte[] m_Buffer;
+    private uint m_Pos;
+    private uint m_Limit;
+    private uint m_BufferSize;
+    private Stream m_Stream;
+    private bool m_StreamWasExhausted;
+    private ulong m_ProcessedSize;
+
+    public InBuffer(uint bufferSize)
+    {
+      this.m_Buffer = new byte[(IntPtr) bufferSize];
+      this.m_BufferSize = bufferSize;
+    }
+
+    public void Init(Stream stream)
+    {
+      this.m_Stream = stream;
+      this.m_ProcessedSize = 0UL;
+      this.m_Limit = 0U;
+      this.m_Pos = 0U;
+      this.m_StreamWasExhausted = false;
+    }
+
+    public bool ReadBlock()
+    {
+      if (this.m_StreamWasExhausted)
+        return false;
+      this.m_ProcessedSize += (ulong) this.m_Pos;
+      int num = this.m_Stream.Read(this.m_Buffer, 0, (int) this.m_BufferSize);
+      this.m_Pos = 0U;
+      this.m_Limit = (uint) num;
+      this.m_StreamWasExhausted = num == 0;
+      return !this.m_StreamWasExhausted;
+    }
+
+    public void ReleaseStream() => this.m_Stream = (Stream) null;
+
+    public bool ReadByte(byte b)
+    {
+      if (this.m_Pos >= this.m_Limit && !this.ReadBlock())
+        return false;
+      b = this.m_Buffer[(IntPtr) this.m_Pos++];
+      return true;
+    }
+
+    public byte ReadByte() => this.m_Pos >= this.m_Limit && !this.ReadBlock() ? byte.MaxValue : this.m_Buffer[(IntPtr) this.m_Pos++];
+
+    public ulong GetProcessedSize() => this.m_ProcessedSize + (ulong) this.m_Pos;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Buffer/OutBuffer.cs

@@ -0,0 +1,58 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Buffer.OutBuffer
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Buffer
+{
+  public class OutBuffer
+  {
+    private byte[] m_Buffer;
+    private uint m_Pos;
+    private uint m_BufferSize;
+    private Stream m_Stream;
+    private ulong m_ProcessedSize;
+
+    public OutBuffer(uint bufferSize)
+    {
+      this.m_Buffer = new byte[(IntPtr) bufferSize];
+      this.m_BufferSize = bufferSize;
+    }
+
+    public void SetStream(Stream stream) => this.m_Stream = stream;
+
+    public void FlushStream() => this.m_Stream.Flush();
+
+    public void CloseStream() => this.m_Stream.Close();
+
+    public void ReleaseStream() => this.m_Stream = (Stream) null;
+
+    public void Init()
+    {
+      this.m_ProcessedSize = 0UL;
+      this.m_Pos = 0U;
+    }
+
+    public void WriteByte(byte b)
+    {
+      this.m_Buffer[(IntPtr) this.m_Pos++] = b;
+      if (this.m_Pos < this.m_BufferSize)
+        return;
+      this.FlushData();
+    }
+
+    public void FlushData()
+    {
+      if (this.m_Pos == 0U)
+        return;
+      this.m_Stream.Write(this.m_Buffer, 0, (int) this.m_Pos);
+      this.m_Pos = 0U;
+    }
+
+    public ulong GetProcessedSize() => this.m_ProcessedSize + (ulong) this.m_Pos;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/CRC.cs

@@ -0,0 +1,53 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.CRC
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+
+namespace SevenZip
+{
+  internal class CRC
+  {
+    public static readonly uint[] Table = new uint[256];
+    private uint _value = uint.MaxValue;
+
+    static CRC()
+    {
+      for (uint index1 = 0; index1 < 256U; ++index1)
+      {
+        uint num = index1;
+        for (int index2 = 0; index2 < 8; ++index2)
+        {
+          if (((int) num & 1) != 0)
+            num = num >> 1 ^ 3988292384U;
+          else
+            num >>= 1;
+        }
+        CRC.Table[(IntPtr) index1] = num;
+      }
+    }
+
+    public void Init() => this._value = uint.MaxValue;
+
+    public void UpdateByte(byte b) => this._value = CRC.Table[(int) (byte) this._value ^ (int) b] ^ this._value >> 8;
+
+    public void Update(byte[] data, uint offset, uint size)
+    {
+      for (uint index = 0; index < size; ++index)
+        this._value = CRC.Table[(int) (byte) this._value ^ (int) data[(IntPtr) (offset + index)]] ^ this._value >> 8;
+    }
+
+    public uint GetDigest() => this._value ^ uint.MaxValue;
+
+    private static uint CalculateDigest(byte[] data, uint offset, uint size)
+    {
+      CRC crc = new CRC();
+      crc.Update(data, offset, size);
+      return crc.GetDigest();
+    }
+
+    private static bool VerifyDigest(uint digest, byte[] data, uint offset, uint size) => (int) CRC.CalculateDigest(data, offset, size) == (int) digest;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/CoderPropID.cs

@@ -0,0 +1,27 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.CoderPropID
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip
+{
+  public enum CoderPropID
+  {
+    DefaultProp,
+    DictionarySize,
+    UsedMemorySize,
+    Order,
+    BlockSize,
+    PosStateBits,
+    LitContextBits,
+    LitPosBits,
+    NumFastBytes,
+    MatchFinder,
+    MatchFinderCycles,
+    NumPasses,
+    Algorithm,
+    NumThreads,
+    EndMarker,
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZ/BinTree.cs

@@ -0,0 +1,370 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.BinTree
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  public class BinTree : InWindow, IMatchFinder, IInWindowStream
+  {
+    private const uint kHash2Size = 1024;
+    private const uint kHash3Size = 65536;
+    private const uint kBT2HashSize = 65536;
+    private const uint kStartMaxLen = 1;
+    private const uint kHash3Offset = 1024;
+    private const uint kEmptyHashValue = 0;
+    private const uint kMaxValForNormalize = 2147483647;
+    private uint _cyclicBufferPos;
+    private uint _cyclicBufferSize;
+    private uint _matchMaxLen;
+    private uint[] _son;
+    private uint[] _hash;
+    private uint _cutValue = (uint) byte.MaxValue;
+    private uint _hashMask;
+    private uint _hashSizeSum;
+    private bool HASH_ARRAY = true;
+    private uint kNumHashDirectBytes;
+    private uint kMinMatchCheck = 4;
+    private uint kFixHashSize = 66560;
+
+    public void SetType(int numHashBytes)
+    {
+      this.HASH_ARRAY = numHashBytes > 2;
+      if (this.HASH_ARRAY)
+      {
+        this.kNumHashDirectBytes = 0U;
+        this.kMinMatchCheck = 4U;
+        this.kFixHashSize = 66560U;
+      }
+      else
+      {
+        this.kNumHashDirectBytes = 2U;
+        this.kMinMatchCheck = 3U;
+        this.kFixHashSize = 0U;
+      }
+    }
+
+    public new void SetStream(Stream stream) => base.SetStream(stream);
+
+    public new void ReleaseStream() => base.ReleaseStream();
+
+    public new void Init()
+    {
+      base.Init();
+      for (uint index = 0; index < this._hashSizeSum; ++index)
+        this._hash[(IntPtr) index] = 0U;
+      this._cyclicBufferPos = 0U;
+      this.ReduceOffsets(-1);
+    }
+
+    public new void MovePos()
+    {
+      if (++this._cyclicBufferPos >= this._cyclicBufferSize)
+        this._cyclicBufferPos = 0U;
+      base.MovePos();
+      if (this._pos != (uint) int.MaxValue)
+        return;
+      this.Normalize();
+    }
+
+    public new byte GetIndexByte(int index) => base.GetIndexByte(index);
+
+    public new uint GetMatchLen(int index, uint distance, uint limit) => base.GetMatchLen(index, distance, limit);
+
+    public new uint GetNumAvailableBytes() => base.GetNumAvailableBytes();
+
+    public void Create(
+      uint historySize,
+      uint keepAddBufferBefore,
+      uint matchMaxLen,
+      uint keepAddBufferAfter)
+    {
+      if (historySize > 2147483391U)
+        throw new Exception();
+      this._cutValue = 16U + (matchMaxLen >> 1);
+      uint keepSizeReserv = (historySize + keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2U + 256U;
+      this.Create(historySize + keepAddBufferBefore, matchMaxLen + keepAddBufferAfter, keepSizeReserv);
+      this._matchMaxLen = matchMaxLen;
+      uint num1 = historySize + 1U;
+      if ((int) this._cyclicBufferSize != (int) num1)
+        this._son = new uint[(IntPtr) ((this._cyclicBufferSize = num1) * 2U)];
+      uint num2 = 65536;
+      if (this.HASH_ARRAY)
+      {
+        uint num3 = historySize - 1U;
+        uint num4 = num3 | num3 >> 1;
+        uint num5 = num4 | num4 >> 2;
+        uint num6 = num5 | num5 >> 4;
+        uint num7 = (num6 | num6 >> 8) >> 1 | (uint) ushort.MaxValue;
+        if (num7 > 16777216U)
+          num7 >>= 1;
+        this._hashMask = num7;
+        num2 = num7 + 1U + this.kFixHashSize;
+      }
+      if ((int) num2 == (int) this._hashSizeSum)
+        return;
+      this._hash = new uint[(IntPtr) (this._hashSizeSum = num2)];
+    }
+
+    public uint GetMatches(uint[] distances)
+    {
+      uint num1;
+      if (this._pos + this._matchMaxLen <= this._streamPos)
+      {
+        num1 = this._matchMaxLen;
+      }
+      else
+      {
+        num1 = this._streamPos - this._pos;
+        if (num1 < this.kMinMatchCheck)
+        {
+          this.MovePos();
+          return 0;
+        }
+      }
+      uint matches = 0;
+      uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
+      uint index1 = this._bufferOffset + this._pos;
+      uint num3 = 1;
+      uint index2 = 0;
+      uint num4 = 0;
+      uint num5;
+      if (this.HASH_ARRAY)
+      {
+        uint num6 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
+        index2 = num6 & 1023U;
+        uint num7 = num6 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
+        num4 = num7 & (uint) ushort.MaxValue;
+        num5 = (num7 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
+      }
+      else
+        num5 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
+      uint num8 = this._hash[(IntPtr) (this.kFixHashSize + num5)];
+      if (this.HASH_ARRAY)
+      {
+        uint num9 = this._hash[(IntPtr) index2];
+        uint num10 = this._hash[(IntPtr) (1024U + num4)];
+        this._hash[(IntPtr) index2] = this._pos;
+        this._hash[(IntPtr) (1024U + num4)] = this._pos;
+        if (num9 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num9)] == (int) this._bufferBase[(IntPtr) index1])
+        {
+          uint[] numArray1 = distances;
+          int num11 = (int) matches;
+          uint num12 = (uint) (num11 + 1);
+          uint index3 = (uint) num11;
+          int num13;
+          num3 = (uint) (num13 = 2);
+          numArray1[(IntPtr) index3] = (uint) num13;
+          uint[] numArray2 = distances;
+          int num14 = (int) num12;
+          matches = (uint) (num14 + 1);
+          uint index4 = (uint) num14;
+          int num15 = (int) this._pos - (int) num9 - 1;
+          numArray2[(IntPtr) index4] = (uint) num15;
+        }
+        if (num10 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num10)] == (int) this._bufferBase[(IntPtr) index1])
+        {
+          if ((int) num10 == (int) num9)
+            matches -= 2U;
+          uint[] numArray3 = distances;
+          int num16 = (int) matches;
+          uint num17 = (uint) (num16 + 1);
+          uint index5 = (uint) num16;
+          int num18;
+          num3 = (uint) (num18 = 3);
+          numArray3[(IntPtr) index5] = (uint) num18;
+          uint[] numArray4 = distances;
+          int num19 = (int) num17;
+          matches = (uint) (num19 + 1);
+          uint index6 = (uint) num19;
+          int num20 = (int) this._pos - (int) num10 - 1;
+          numArray4[(IntPtr) index6] = (uint) num20;
+          num9 = num10;
+        }
+        if (matches != 0U && (int) num9 == (int) num8)
+        {
+          matches -= 2U;
+          num3 = 1U;
+        }
+      }
+      this._hash[(IntPtr) (this.kFixHashSize + num5)] = this._pos;
+      uint index7 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
+      uint index8 = this._cyclicBufferPos << 1;
+      uint val2;
+      uint val1 = val2 = this.kNumHashDirectBytes;
+      if (this.kNumHashDirectBytes != 0U && num8 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num8 + this.kNumHashDirectBytes)] != (int) this._bufferBase[(IntPtr) (index1 + this.kNumHashDirectBytes)])
+      {
+        uint[] numArray5 = distances;
+        int num21 = (int) matches;
+        uint num22 = (uint) (num21 + 1);
+        uint index9 = (uint) num21;
+        int numHashDirectBytes;
+        num3 = (uint) (numHashDirectBytes = (int) this.kNumHashDirectBytes);
+        numArray5[(IntPtr) index9] = (uint) numHashDirectBytes;
+        uint[] numArray6 = distances;
+        int num23 = (int) num22;
+        matches = (uint) (num23 + 1);
+        uint index10 = (uint) num23;
+        int num24 = (int) this._pos - (int) num8 - 1;
+        numArray6[(IntPtr) index10] = (uint) num24;
+      }
+      uint cutValue = this._cutValue;
+      while (num8 > num2 && cutValue-- != 0U)
+      {
+        uint num25 = this._pos - num8;
+        uint index11 = (uint) ((num25 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num25 : (int) this._cyclicBufferPos - (int) num25 + (int) this._cyclicBufferSize) << 1);
+        uint num26 = this._bufferOffset + num8;
+        uint num27 = Math.Min(val1, val2);
+        if ((int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)])
+        {
+          do
+            ;
+          while ((int) ++num27 != (int) num1 && (int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)]);
+          if (num3 < num27)
+          {
+            uint[] numArray7 = distances;
+            int num28 = (int) matches;
+            uint num29 = (uint) (num28 + 1);
+            uint index12 = (uint) num28;
+            int num30;
+            num3 = (uint) (num30 = (int) num27);
+            numArray7[(IntPtr) index12] = (uint) num30;
+            uint[] numArray8 = distances;
+            int num31 = (int) num29;
+            matches = (uint) (num31 + 1);
+            uint index13 = (uint) num31;
+            int num32 = (int) num25 - 1;
+            numArray8[(IntPtr) index13] = (uint) num32;
+            if ((int) num27 == (int) num1)
+            {
+              this._son[(IntPtr) index8] = this._son[(IntPtr) index11];
+              this._son[(IntPtr) index7] = this._son[(IntPtr) (index11 + 1U)];
+              goto label_29;
+            }
+          }
+        }
+        if ((int) this._bufferBase[(IntPtr) (num26 + num27)] < (int) this._bufferBase[(IntPtr) (index1 + num27)])
+        {
+          this._son[(IntPtr) index8] = num8;
+          index8 = index11 + 1U;
+          num8 = this._son[(IntPtr) index8];
+          val2 = num27;
+        }
+        else
+        {
+          this._son[(IntPtr) index7] = num8;
+          index7 = index11;
+          num8 = this._son[(IntPtr) index7];
+          val1 = num27;
+        }
+      }
+      this._son[(IntPtr) index7] = this._son[(IntPtr) index8] = 0U;
+label_29:
+      this.MovePos();
+      return matches;
+    }
+
+    public void Skip(uint num)
+    {
+      do
+      {
+        uint num1;
+        if (this._pos + this._matchMaxLen <= this._streamPos)
+        {
+          num1 = this._matchMaxLen;
+        }
+        else
+        {
+          num1 = this._streamPos - this._pos;
+          if (num1 < this.kMinMatchCheck)
+          {
+            this.MovePos();
+            goto label_19;
+          }
+        }
+        uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
+        uint index1 = this._bufferOffset + this._pos;
+        uint num3;
+        if (this.HASH_ARRAY)
+        {
+          uint num4 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
+          this._hash[(IntPtr) (num4 & 1023U)] = this._pos;
+          uint num5 = num4 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
+          this._hash[(IntPtr) (1024U + (num5 & (uint) ushort.MaxValue))] = this._pos;
+          num3 = (num5 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
+        }
+        else
+          num3 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
+        uint num6 = this._hash[(IntPtr) (this.kFixHashSize + num3)];
+        this._hash[(IntPtr) (this.kFixHashSize + num3)] = this._pos;
+        uint index2 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
+        uint index3 = this._cyclicBufferPos << 1;
+        uint val2;
+        uint val1 = val2 = this.kNumHashDirectBytes;
+        uint cutValue = this._cutValue;
+        while (num6 > num2 && cutValue-- != 0U)
+        {
+          uint num7 = this._pos - num6;
+          uint index4 = (uint) ((num7 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num7 : (int) this._cyclicBufferPos - (int) num7 + (int) this._cyclicBufferSize) << 1);
+          uint num8 = this._bufferOffset + num6;
+          uint num9 = Math.Min(val1, val2);
+          if ((int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)])
+          {
+            do
+              ;
+            while ((int) ++num9 != (int) num1 && (int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)]);
+            if ((int) num9 == (int) num1)
+            {
+              this._son[(IntPtr) index3] = this._son[(IntPtr) index4];
+              this._son[(IntPtr) index2] = this._son[(IntPtr) (index4 + 1U)];
+              goto label_18;
+            }
+          }
+          if ((int) this._bufferBase[(IntPtr) (num8 + num9)] < (int) this._bufferBase[(IntPtr) (index1 + num9)])
+          {
+            this._son[(IntPtr) index3] = num6;
+            index3 = index4 + 1U;
+            num6 = this._son[(IntPtr) index3];
+            val2 = num9;
+          }
+          else
+          {
+            this._son[(IntPtr) index2] = num6;
+            index2 = index4;
+            num6 = this._son[(IntPtr) index2];
+            val1 = num9;
+          }
+        }
+        this._son[(IntPtr) index2] = this._son[(IntPtr) index3] = 0U;
+label_18:
+        this.MovePos();
+label_19:;
+      }
+      while (--num != 0U);
+    }
+
+    private void NormalizeLinks(uint[] items, uint numItems, uint subValue)
+    {
+      for (uint index = 0; index < numItems; ++index)
+      {
+        uint num1 = items[(IntPtr) index];
+        uint num2 = num1 > subValue ? num1 - subValue : 0U;
+        items[(IntPtr) index] = num2;
+      }
+    }
+
+    private void Normalize()
+    {
+      uint subValue = this._pos - this._cyclicBufferSize;
+      this.NormalizeLinks(this._son, this._cyclicBufferSize * 2U, subValue);
+      this.NormalizeLinks(this._hash, this._hashSizeSum, subValue);
+      this.ReduceOffsets((int) subValue);
+    }
+
+    public void SetCutValue(uint cutValue) => this._cutValue = cutValue;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZ/IInWindowStream.cs

@@ -0,0 +1,25 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.IInWindowStream
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  internal interface IInWindowStream
+  {
+    void SetStream(Stream inStream);
+
+    void Init();
+
+    void ReleaseStream();
+
+    byte GetIndexByte(int index);
+
+    uint GetMatchLen(int index, uint distance, uint limit);
+
+    uint GetNumAvailableBytes();
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZ/IMatchFinder.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.IMatchFinder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip.Compression.LZ
+{
+  internal interface IMatchFinder : IInWindowStream
+  {
+    void Create(
+      uint historySize,
+      uint keepAddBufferBefore,
+      uint matchMaxLen,
+      uint keepAddBufferAfter);
+
+    uint GetMatches(uint[] distances);
+
+    void Skip(uint num);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZ/InWindow.cs

@@ -0,0 +1,127 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.InWindow
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  public class InWindow
+  {
+    public byte[] _bufferBase;
+    private Stream _stream;
+    private uint _posLimit;
+    private bool _streamEndWasReached;
+    private uint _pointerToLastSafePosition;
+    public uint _bufferOffset;
+    public uint _blockSize;
+    public uint _pos;
+    private uint _keepSizeBefore;
+    private uint _keepSizeAfter;
+    public uint _streamPos;
+
+    public void MoveBlock()
+    {
+      uint num1 = this._bufferOffset + this._pos - this._keepSizeBefore;
+      if (num1 > 0U)
+        --num1;
+      uint num2 = this._bufferOffset + this._streamPos - num1;
+      for (uint index = 0; index < num2; ++index)
+        this._bufferBase[(IntPtr) index] = this._bufferBase[(IntPtr) (num1 + index)];
+      this._bufferOffset -= num1;
+    }
+
+    public virtual void ReadBlock()
+    {
+      if (this._streamEndWasReached)
+        return;
+      while (true)
+      {
+        do
+        {
+          int count = -(int) this._bufferOffset + (int) this._blockSize - (int) this._streamPos;
+          if (count == 0)
+            return;
+          int num = this._stream.Read(this._bufferBase, (int) this._bufferOffset + (int) this._streamPos, count);
+          if (num == 0)
+          {
+            this._posLimit = this._streamPos;
+            if (this._bufferOffset + this._posLimit > this._pointerToLastSafePosition)
+              this._posLimit = this._pointerToLastSafePosition - this._bufferOffset;
+            this._streamEndWasReached = true;
+            return;
+          }
+          this._streamPos += (uint) num;
+        }
+        while (this._streamPos < this._pos + this._keepSizeAfter);
+        this._posLimit = this._streamPos - this._keepSizeAfter;
+      }
+    }
+
+    private void Free() => this._bufferBase = (byte[]) null;
+
+    public void Create(uint keepSizeBefore, uint keepSizeAfter, uint keepSizeReserv)
+    {
+      this._keepSizeBefore = keepSizeBefore;
+      this._keepSizeAfter = keepSizeAfter;
+      uint num = keepSizeBefore + keepSizeAfter + keepSizeReserv;
+      if (this._bufferBase == null || (int) this._blockSize != (int) num)
+      {
+        this.Free();
+        this._blockSize = num;
+        this._bufferBase = new byte[(IntPtr) this._blockSize];
+      }
+      this._pointerToLastSafePosition = this._blockSize - keepSizeAfter;
+    }
+
+    public void SetStream(Stream stream) => this._stream = stream;
+
+    public void ReleaseStream() => this._stream = (Stream) null;
+
+    public void Init()
+    {
+      this._bufferOffset = 0U;
+      this._pos = 0U;
+      this._streamPos = 0U;
+      this._streamEndWasReached = false;
+      this.ReadBlock();
+    }
+
+    public void MovePos()
+    {
+      ++this._pos;
+      if (this._pos <= this._posLimit)
+        return;
+      if (this._bufferOffset + this._pos > this._pointerToLastSafePosition)
+        this.MoveBlock();
+      this.ReadBlock();
+    }
+
+    public byte GetIndexByte(int index) => this._bufferBase[(long) (this._bufferOffset + this._pos) + (long) index];
+
+    public uint GetMatchLen(int index, uint distance, uint limit)
+    {
+      if (this._streamEndWasReached && (long) this._pos + (long) index + (long) limit > (long) this._streamPos)
+        limit = this._streamPos - (uint) ((ulong) this._pos + (ulong) index);
+      ++distance;
+      uint num = (uint) ((int) this._bufferOffset + (int) this._pos + index);
+      uint matchLen = 0;
+      while (matchLen < limit && (int) this._bufferBase[(IntPtr) (num + matchLen)] == (int) this._bufferBase[(IntPtr) (num + matchLen - distance)])
+        ++matchLen;
+      return matchLen;
+    }
+
+    public uint GetNumAvailableBytes() => this._streamPos - this._pos;
+
+    public void ReduceOffsets(int subValue)
+    {
+      this._bufferOffset += (uint) subValue;
+      this._posLimit -= (uint) subValue;
+      this._pos -= (uint) subValue;
+      this._streamPos -= (uint) subValue;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZ/OutWindow.cs

@@ -0,0 +1,113 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.OutWindow
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  public class OutWindow
+  {
+    private byte[] _buffer;
+    private uint _pos;
+    private uint _windowSize;
+    private uint _streamPos;
+    private Stream _stream;
+    public uint TrainSize;
+
+    public void Create(uint windowSize)
+    {
+      if ((int) this._windowSize != (int) windowSize)
+        this._buffer = new byte[(IntPtr) windowSize];
+      this._windowSize = windowSize;
+      this._pos = 0U;
+      this._streamPos = 0U;
+    }
+
+    public void Init(Stream stream, bool solid)
+    {
+      this.ReleaseStream();
+      this._stream = stream;
+      if (solid)
+        return;
+      this._streamPos = 0U;
+      this._pos = 0U;
+      this.TrainSize = 0U;
+    }
+
+    public bool Train(Stream stream)
+    {
+      long length = stream.Length;
+      uint num1 = length < (long) this._windowSize ? (uint) length : this._windowSize;
+      this.TrainSize = num1;
+      stream.Position = length - (long) num1;
+      this._streamPos = this._pos = 0U;
+      while (num1 > 0U)
+      {
+        uint count = this._windowSize - this._pos;
+        if (num1 < count)
+          count = num1;
+        int num2 = stream.Read(this._buffer, (int) this._pos, (int) count);
+        if (num2 == 0)
+          return false;
+        num1 -= (uint) num2;
+        this._pos += (uint) num2;
+        this._streamPos += (uint) num2;
+        if ((int) this._pos == (int) this._windowSize)
+          this._streamPos = this._pos = 0U;
+      }
+      return true;
+    }
+
+    public void ReleaseStream()
+    {
+      this.Flush();
+      this._stream = (Stream) null;
+    }
+
+    public void Flush()
+    {
+      uint count = this._pos - this._streamPos;
+      if (count == 0U)
+        return;
+      this._stream.Write(this._buffer, (int) this._streamPos, (int) count);
+      if (this._pos >= this._windowSize)
+        this._pos = 0U;
+      this._streamPos = this._pos;
+    }
+
+    public void CopyBlock(uint distance, uint len)
+    {
+      uint num = (uint) ((int) this._pos - (int) distance - 1);
+      if (num >= this._windowSize)
+        num += this._windowSize;
+      for (; len > 0U; --len)
+      {
+        if (num >= this._windowSize)
+          num = 0U;
+        this._buffer[(IntPtr) this._pos++] = this._buffer[(IntPtr) num++];
+        if (this._pos >= this._windowSize)
+          this.Flush();
+      }
+    }
+
+    public void PutByte(byte b)
+    {
+      this._buffer[(IntPtr) this._pos++] = b;
+      if (this._pos < this._windowSize)
+        return;
+      this.Flush();
+    }
+
+    public byte GetByte(uint distance)
+    {
+      uint index = (uint) ((int) this._pos - (int) distance - 1);
+      if (index >= this._windowSize)
+        index += this._windowSize;
+      return this._buffer[(IntPtr) index];
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZMA/Base.cs

@@ -0,0 +1,70 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZMA.Base
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip.Compression.LZMA
+{
+  internal abstract class Base
+  {
+    public const uint kNumRepDistances = 4;
+    public const uint kNumStates = 12;
+    public const int kNumPosSlotBits = 6;
+    public const int kDicLogSizeMin = 0;
+    public const int kNumLenToPosStatesBits = 2;
+    public const uint kNumLenToPosStates = 4;
+    public const uint kMatchMinLen = 2;
+    public const int kNumAlignBits = 4;
+    public const uint kAlignTableSize = 16;
+    public const uint kAlignMask = 15;
+    public const uint kStartPosModelIndex = 4;
+    public const uint kEndPosModelIndex = 14;
+    public const uint kNumPosModels = 10;
+    public const uint kNumFullDistances = 128;
+    public const uint kNumLitPosStatesBitsEncodingMax = 4;
+    public const uint kNumLitContextBitsMax = 8;
+    public const int kNumPosStatesBitsMax = 4;
+    public const uint kNumPosStatesMax = 16;
+    public const int kNumPosStatesBitsEncodingMax = 4;
+    public const uint kNumPosStatesEncodingMax = 16;
+    public const int kNumLowLenBits = 3;
+    public const int kNumMidLenBits = 3;
+    public const int kNumHighLenBits = 8;
+    public const uint kNumLowLenSymbols = 8;
+    public const uint kNumMidLenSymbols = 8;
+    public const uint kNumLenSymbols = 272;
+    public const uint kMatchMaxLen = 273;
+
+    public static uint GetLenToPosState(uint len)
+    {
+      len -= 2U;
+      return len < 4U ? len : 3U;
+    }
+
+    public struct State
+    {
+      public uint Index;
+
+      public void Init() => this.Index = 0U;
+
+      public void UpdateChar()
+      {
+        if (this.Index < 4U)
+          this.Index = 0U;
+        else if (this.Index < 10U)
+          this.Index -= 3U;
+        else
+          this.Index -= 6U;
+      }
+
+      public void UpdateMatch() => this.Index = this.Index < 7U ? 7U : 10U;
+
+      public void UpdateRep() => this.Index = this.Index < 7U ? 8U : 11U;
+
+      public void UpdateShortRep() => this.Index = this.Index < 7U ? 9U : 11U;
+
+      public bool IsCharState() => this.Index < 7U;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZMA/Decoder.cs

@@ -0,0 +1,353 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZMA.Decoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using SevenZip.Compression.LZ;
+using SevenZip.Compression.RangeCoder;
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZMA
+{
+  public class Decoder : ICoder, ISetDecoderProperties
+  {
+    private OutWindow m_OutWindow = new OutWindow();
+    private SevenZip.Compression.RangeCoder.Decoder m_RangeDecoder = new SevenZip.Compression.RangeCoder.Decoder();
+    private BitDecoder[] m_IsMatchDecoders = new BitDecoder[new IntPtr(192)];
+    private BitDecoder[] m_IsRepDecoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRepG0Decoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRepG1Decoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRepG2Decoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRep0LongDecoders = new BitDecoder[new IntPtr(192)];
+    private BitTreeDecoder[] m_PosSlotDecoder = new BitTreeDecoder[new IntPtr(4)];
+    private BitDecoder[] m_PosDecoders = new BitDecoder[new IntPtr(114)];
+    private BitTreeDecoder m_PosAlignDecoder = new BitTreeDecoder(4);
+    private Decoder.LenDecoder m_LenDecoder = new Decoder.LenDecoder();
+    private Decoder.LenDecoder m_RepLenDecoder = new Decoder.LenDecoder();
+    private Decoder.LiteralDecoder m_LiteralDecoder = new Decoder.LiteralDecoder();
+    private uint m_DictionarySize;
+    private uint m_DictionarySizeCheck;
+    private uint m_PosStateMask;
+    private bool _solid;
+
+    public Decoder()
+    {
+      this.m_DictionarySize = uint.MaxValue;
+      for (int index = 0; index < 4; ++index)
+        this.m_PosSlotDecoder[index] = new BitTreeDecoder(6);
+    }
+
+    private void SetDictionarySize(uint dictionarySize)
+    {
+      if ((int) this.m_DictionarySize == (int) dictionarySize)
+        return;
+      this.m_DictionarySize = dictionarySize;
+      this.m_DictionarySizeCheck = Math.Max(this.m_DictionarySize, 1U);
+      this.m_OutWindow.Create(Math.Max(this.m_DictionarySizeCheck, 4096U));
+    }
+
+    private void SetLiteralProperties(int lp, int lc)
+    {
+      if (lp > 8)
+        throw new InvalidParamException();
+      if (lc > 8)
+        throw new InvalidParamException();
+      this.m_LiteralDecoder.Create(lp, lc);
+    }
+
+    private void SetPosBitsProperties(int pb)
+    {
+      if (pb > 4)
+        throw new InvalidParamException();
+      uint numPosStates = (uint) (1 << pb);
+      this.m_LenDecoder.Create(numPosStates);
+      this.m_RepLenDecoder.Create(numPosStates);
+      this.m_PosStateMask = numPosStates - 1U;
+    }
+
+    private void Init(Stream inStream, Stream outStream)
+    {
+      this.m_RangeDecoder.Init(inStream);
+      this.m_OutWindow.Init(outStream, this._solid);
+      for (uint index1 = 0; index1 < 12U; ++index1)
+      {
+        for (uint index2 = 0; index2 <= this.m_PosStateMask; ++index2)
+        {
+          uint index3 = (index1 << 4) + index2;
+          this.m_IsMatchDecoders[(IntPtr) index3].Init();
+          this.m_IsRep0LongDecoders[(IntPtr) index3].Init();
+        }
+        this.m_IsRepDecoders[(IntPtr) index1].Init();
+        this.m_IsRepG0Decoders[(IntPtr) index1].Init();
+        this.m_IsRepG1Decoders[(IntPtr) index1].Init();
+        this.m_IsRepG2Decoders[(IntPtr) index1].Init();
+      }
+      this.m_LiteralDecoder.Init();
+      for (uint index = 0; index < 4U; ++index)
+        this.m_PosSlotDecoder[(IntPtr) index].Init();
+      for (uint index = 0; index < 114U; ++index)
+        this.m_PosDecoders[(IntPtr) index].Init();
+      this.m_LenDecoder.Init();
+      this.m_RepLenDecoder.Init();
+      this.m_PosAlignDecoder.Init();
+    }
+
+    public void Code(
+      Stream inStream,
+      Stream outStream,
+      long inSize,
+      long outSize,
+      ICodeProgress progress)
+    {
+      this.Init(inStream, outStream);
+      Base.State state = new Base.State();
+      state.Init();
+      uint distance = 0;
+      uint num1 = 0;
+      uint num2 = 0;
+      uint num3 = 0;
+      ulong pos = 0;
+      ulong num4 = (ulong) outSize;
+      if (pos < num4)
+      {
+        if (this.m_IsMatchDecoders[(IntPtr) (state.Index << 4)].Decode(this.m_RangeDecoder) != 0U)
+          throw new DataErrorException();
+        state.UpdateChar();
+        this.m_OutWindow.PutByte(this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, 0U, (byte) 0));
+        ++pos;
+      }
+      while (pos < num4)
+      {
+        uint posState = (uint) pos & this.m_PosStateMask;
+        if (this.m_IsMatchDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
+        {
+          byte prevByte = this.m_OutWindow.GetByte(0U);
+          this.m_OutWindow.PutByte(state.IsCharState() ? this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, (uint) pos, prevByte) : this.m_LiteralDecoder.DecodeWithMatchByte(this.m_RangeDecoder, (uint) pos, prevByte, this.m_OutWindow.GetByte(distance)));
+          state.UpdateChar();
+          ++pos;
+        }
+        else
+        {
+          uint len;
+          if (this.m_IsRepDecoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 1U)
+          {
+            if (this.m_IsRepG0Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
+            {
+              if (this.m_IsRep0LongDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
+              {
+                state.UpdateShortRep();
+                this.m_OutWindow.PutByte(this.m_OutWindow.GetByte(distance));
+                ++pos;
+                continue;
+              }
+            }
+            else
+            {
+              uint num5;
+              if (this.m_IsRepG1Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
+              {
+                num5 = num1;
+              }
+              else
+              {
+                if (this.m_IsRepG2Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
+                {
+                  num5 = num2;
+                }
+                else
+                {
+                  num5 = num3;
+                  num3 = num2;
+                }
+                num2 = num1;
+              }
+              num1 = distance;
+              distance = num5;
+            }
+            len = this.m_RepLenDecoder.Decode(this.m_RangeDecoder, posState) + 2U;
+            state.UpdateRep();
+          }
+          else
+          {
+            num3 = num2;
+            num2 = num1;
+            num1 = distance;
+            len = 2U + this.m_LenDecoder.Decode(this.m_RangeDecoder, posState);
+            state.UpdateMatch();
+            uint num6 = this.m_PosSlotDecoder[(IntPtr) Base.GetLenToPosState(len)].Decode(this.m_RangeDecoder);
+            if (num6 >= 4U)
+            {
+              int NumBitLevels = (int) (num6 >> 1) - 1;
+              uint num7 = (uint) ((2 | (int) num6 & 1) << NumBitLevels);
+              distance = num6 >= 14U ? num7 + (this.m_RangeDecoder.DecodeDirectBits(NumBitLevels - 4) << 4) + this.m_PosAlignDecoder.ReverseDecode(this.m_RangeDecoder) : num7 + BitTreeDecoder.ReverseDecode(this.m_PosDecoders, (uint) ((int) num7 - (int) num6 - 1), this.m_RangeDecoder, NumBitLevels);
+            }
+            else
+              distance = num6;
+          }
+          if ((ulong) distance >= (ulong) this.m_OutWindow.TrainSize + pos || distance >= this.m_DictionarySizeCheck)
+          {
+            if (distance != uint.MaxValue)
+              throw new DataErrorException();
+            break;
+          }
+          this.m_OutWindow.CopyBlock(distance, len);
+          pos += (ulong) len;
+        }
+      }
+      this.m_OutWindow.Flush();
+      this.m_OutWindow.ReleaseStream();
+      this.m_RangeDecoder.ReleaseStream();
+    }
+
+    public void SetDecoderProperties(byte[] properties)
+    {
+      if (properties.Length < 5)
+        throw new InvalidParamException();
+      int lc = (int) properties[0] % 9;
+      int num = (int) properties[0] / 9;
+      int lp = num % 5;
+      int pb = num / 5;
+      if (pb > 4)
+        throw new InvalidParamException();
+      uint dictionarySize = 0;
+      for (int index = 0; index < 4; ++index)
+        dictionarySize += (uint) properties[1 + index] << index * 8;
+      this.SetDictionarySize(dictionarySize);
+      this.SetLiteralProperties(lp, lc);
+      this.SetPosBitsProperties(pb);
+    }
+
+    public bool Train(Stream stream)
+    {
+      this._solid = true;
+      return this.m_OutWindow.Train(stream);
+    }
+
+    private class LenDecoder
+    {
+      private BitDecoder m_Choice = new BitDecoder();
+      private BitDecoder m_Choice2 = new BitDecoder();
+      private BitTreeDecoder[] m_LowCoder = new BitTreeDecoder[new IntPtr(16)];
+      private BitTreeDecoder[] m_MidCoder = new BitTreeDecoder[new IntPtr(16)];
+      private BitTreeDecoder m_HighCoder = new BitTreeDecoder(8);
+      private uint m_NumPosStates;
+
+      public void Create(uint numPosStates)
+      {
+        for (uint numPosStates1 = this.m_NumPosStates; numPosStates1 < numPosStates; ++numPosStates1)
+        {
+          this.m_LowCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
+          this.m_MidCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
+        }
+        this.m_NumPosStates = numPosStates;
+      }
+
+      public void Init()
+      {
+        this.m_Choice.Init();
+        for (uint index = 0; index < this.m_NumPosStates; ++index)
+        {
+          this.m_LowCoder[(IntPtr) index].Init();
+          this.m_MidCoder[(IntPtr) index].Init();
+        }
+        this.m_Choice2.Init();
+        this.m_HighCoder.Init();
+      }
+
+      public uint Decode(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint posState)
+      {
+        if (this.m_Choice.Decode(rangeDecoder) == 0U)
+          return this.m_LowCoder[(IntPtr) posState].Decode(rangeDecoder);
+        uint num = 8;
+        return this.m_Choice2.Decode(rangeDecoder) != 0U ? num + 8U + this.m_HighCoder.Decode(rangeDecoder) : num + this.m_MidCoder[(IntPtr) posState].Decode(rangeDecoder);
+      }
+    }
+
+    private class LiteralDecoder
+    {
+      private Decoder.LiteralDecoder.Decoder2[] m_Coders;
+      private int m_NumPrevBits;
+      private int m_NumPosBits;
+      private uint m_PosMask;
+
+      public void Create(int numPosBits, int numPrevBits)
+      {
+        if (this.m_Coders != null && this.m_NumPrevBits == numPrevBits && this.m_NumPosBits == numPosBits)
+          return;
+        this.m_NumPosBits = numPosBits;
+        this.m_PosMask = (uint) ((1 << numPosBits) - 1);
+        this.m_NumPrevBits = numPrevBits;
+        uint length = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
+        this.m_Coders = new Decoder.LiteralDecoder.Decoder2[(IntPtr) length];
+        for (uint index = 0; index < length; ++index)
+          this.m_Coders[(IntPtr) index].Create();
+      }
+
+      public void Init()
+      {
+        uint num = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
+        for (uint index = 0; index < num; ++index)
+          this.m_Coders[(IntPtr) index].Init();
+      }
+
+      private uint GetState(uint pos, byte prevByte) => (uint) ((((int) pos & (int) this.m_PosMask) << this.m_NumPrevBits) + ((int) prevByte >> 8 - this.m_NumPrevBits));
+
+      public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint pos, byte prevByte) => this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeNormal(rangeDecoder);
+
+      public byte DecodeWithMatchByte(
+        SevenZip.Compression.RangeCoder.Decoder rangeDecoder,
+        uint pos,
+        byte prevByte,
+        byte matchByte)
+      {
+        return this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeWithMatchByte(rangeDecoder, matchByte);
+      }
+
+      private struct Decoder2
+      {
+        private BitDecoder[] m_Decoders;
+
+        public void Create() => this.m_Decoders = new BitDecoder[768];
+
+        public void Init()
+        {
+          for (int index = 0; index < 768; ++index)
+            this.m_Decoders[index].Init();
+        }
+
+        public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder)
+        {
+          uint index = 1;
+          do
+          {
+            index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
+          }
+          while (index < 256U);
+          return (byte) index;
+        }
+
+        public byte DecodeWithMatchByte(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, byte matchByte)
+        {
+          uint index = 1;
+          do
+          {
+            uint num1 = (uint) ((int) matchByte >> 7 & 1);
+            matchByte <<= 1;
+            uint num2 = this.m_Decoders[(IntPtr) ((uint) (1 + (int) num1 << 8) + index)].Decode(rangeDecoder);
+            index = index << 1 | num2;
+            if ((int) num1 != (int) num2)
+            {
+              while (index < 256U)
+                index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
+              break;
+            }
+          }
+          while (index < 256U);
+          return (byte) index;
+        }
+      }
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/LZMA/SevenZipHelper.cs

@@ -0,0 +1,76 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZMA.SevenZipHelper
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZMA
+{
+  public static class SevenZipHelper
+  {
+    private static int dictionary = 8388608;
+    private static bool eos = false;
+    private static CoderPropID[] propIDs = new CoderPropID[8]
+    {
+      CoderPropID.DictionarySize,
+      CoderPropID.PosStateBits,
+      CoderPropID.LitContextBits,
+      CoderPropID.LitPosBits,
+      CoderPropID.Algorithm,
+      CoderPropID.NumFastBytes,
+      CoderPropID.MatchFinder,
+      CoderPropID.EndMarker
+    };
+    private static object[] properties = new object[8]
+    {
+      (object) SevenZipHelper.dictionary,
+      (object) 2,
+      (object) 3,
+      (object) 0,
+      (object) 2,
+      (object) 128,
+      (object) "bt4",
+      (object) SevenZipHelper.eos
+    };
+
+    public static byte[] Compress(byte[] inputBytes)
+    {
+      MemoryStream inStream = new MemoryStream(inputBytes);
+      MemoryStream outStream = new MemoryStream();
+      Encoder encoder = new Encoder();
+      encoder.SetCoderProperties(SevenZipHelper.propIDs, SevenZipHelper.properties);
+      encoder.WriteCoderProperties((Stream) outStream);
+      long length = inStream.Length;
+      for (int index = 0; index < 8; ++index)
+        outStream.WriteByte((byte) (length >> 8 * index));
+      encoder.Code((Stream) inStream, (Stream) outStream, -1L, -1L, (ICodeProgress) null);
+      return outStream.ToArray();
+    }
+
+    public static byte[] Decompress(byte[] inputBytes)
+    {
+      MemoryStream inStream = new MemoryStream(inputBytes);
+      Decoder decoder = new Decoder();
+      inStream.Seek(0L, SeekOrigin.Begin);
+      MemoryStream outStream = new MemoryStream();
+      byte[] numArray = new byte[5];
+      if (inStream.Read(numArray, 0, 5) != 5)
+        throw new Exception("input .lzma is too short");
+      long outSize = 0;
+      for (int index = 0; index < 8; ++index)
+      {
+        int num = inStream.ReadByte();
+        if (num < 0)
+          throw new Exception("Can't Read 1");
+        outSize |= (long) (byte) num << 8 * index;
+      }
+      decoder.SetDecoderProperties(numArray);
+      long inSize = inStream.Length - inStream.Position;
+      decoder.Code((Stream) inStream, (Stream) outStream, inSize, outSize, (ICodeProgress) null);
+      return outStream.ToArray();
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/RangeCoder/BitDecoder.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitDecoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitDecoder
+  {
+    public const int kNumBitModelTotalBits = 11;
+    public const uint kBitModelTotal = 2048;
+    private const int kNumMoveBits = 5;
+    private uint Prob;
+
+    public void UpdateModel(int numMoveBits, uint symbol)
+    {
+      if (symbol == 0U)
+        this.Prob += 2048U - this.Prob >> numMoveBits;
+      else
+        this.Prob -= this.Prob >> numMoveBits;
+    }
+
+    public void Init() => this.Prob = 1024U;
+
+    public uint Decode(Decoder rangeDecoder)
+    {
+      uint num = (rangeDecoder.Range >> 11) * this.Prob;
+      if (rangeDecoder.Code < num)
+      {
+        rangeDecoder.Range = num;
+        this.Prob += 2048U - this.Prob >> 5;
+        if (rangeDecoder.Range < 16777216U)
+        {
+          rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
+          rangeDecoder.Range <<= 8;
+        }
+        return 0;
+      }
+      rangeDecoder.Range -= num;
+      rangeDecoder.Code -= num;
+      this.Prob -= this.Prob >> 5;
+      if (rangeDecoder.Range < 16777216U)
+      {
+        rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
+        rangeDecoder.Range <<= 8;
+      }
+      return 1;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/RangeCoder/BitEncoder.cs

@@ -0,0 +1,68 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitEncoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitEncoder
+  {
+    public const int kNumBitModelTotalBits = 11;
+    public const uint kBitModelTotal = 2048;
+    private const int kNumMoveBits = 5;
+    private const int kNumMoveReducingBits = 2;
+    public const int kNumBitPriceShiftBits = 6;
+    private uint Prob;
+    private static uint[] ProbPrices = new uint[new IntPtr(512)];
+
+    public void Init() => this.Prob = 1024U;
+
+    public void UpdateModel(uint symbol)
+    {
+      if (symbol == 0U)
+        this.Prob += 2048U - this.Prob >> 5;
+      else
+        this.Prob -= this.Prob >> 5;
+    }
+
+    public void Encode(Encoder encoder, uint symbol)
+    {
+      uint num = (encoder.Range >> 11) * this.Prob;
+      if (symbol == 0U)
+      {
+        encoder.Range = num;
+        this.Prob += 2048U - this.Prob >> 5;
+      }
+      else
+      {
+        encoder.Low += (ulong) num;
+        encoder.Range -= num;
+        this.Prob -= this.Prob >> 5;
+      }
+      if (encoder.Range >= 16777216U)
+        return;
+      encoder.Range <<= 8;
+      encoder.ShiftLow();
+    }
+
+    static BitEncoder()
+    {
+      for (int index1 = 8; index1 >= 0; --index1)
+      {
+        uint num1 = (uint) (1 << 9 - index1 - 1);
+        uint num2 = (uint) (1 << 9 - index1);
+        for (uint index2 = num1; index2 < num2; ++index2)
+          BitEncoder.ProbPrices[(IntPtr) index2] = (uint) (index1 << 6) + ((uint) ((int) num2 - (int) index2 << 6) >> 9 - index1 - 1);
+      }
+    }
+
+    public uint GetPrice(uint symbol) => BitEncoder.ProbPrices[(((long) (this.Prob - symbol) ^ (long) -(int) symbol) & 2047L) >> 2];
+
+    public uint GetPrice0() => BitEncoder.ProbPrices[(IntPtr) (this.Prob >> 2)];
+
+    public uint GetPrice1() => BitEncoder.ProbPrices[(IntPtr) (2048U - this.Prob >> 2)];
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/RangeCoder/BitTreeDecoder.cs

@@ -0,0 +1,66 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitTreeDecoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitTreeDecoder
+  {
+    private BitDecoder[] Models;
+    private int NumBitLevels;
+
+    public BitTreeDecoder(int numBitLevels)
+    {
+      this.NumBitLevels = numBitLevels;
+      this.Models = new BitDecoder[1 << numBitLevels];
+    }
+
+    public void Init()
+    {
+      for (uint index = 1; (long) index < (long) (1 << this.NumBitLevels); ++index)
+        this.Models[(IntPtr) index].Init();
+    }
+
+    public uint Decode(Decoder rangeDecoder)
+    {
+      uint index = 1;
+      for (int numBitLevels = this.NumBitLevels; numBitLevels > 0; --numBitLevels)
+        index = (index << 1) + this.Models[(IntPtr) index].Decode(rangeDecoder);
+      return index - (uint) (1 << this.NumBitLevels);
+    }
+
+    public uint ReverseDecode(Decoder rangeDecoder)
+    {
+      uint index1 = 1;
+      uint num1 = 0;
+      for (int index2 = 0; index2 < this.NumBitLevels; ++index2)
+      {
+        uint num2 = this.Models[(IntPtr) index1].Decode(rangeDecoder);
+        index1 = (index1 << 1) + num2;
+        num1 |= num2 << index2;
+      }
+      return num1;
+    }
+
+    public static uint ReverseDecode(
+      BitDecoder[] Models,
+      uint startIndex,
+      Decoder rangeDecoder,
+      int NumBitLevels)
+    {
+      uint num1 = 1;
+      uint num2 = 0;
+      for (int index = 0; index < NumBitLevels; ++index)
+      {
+        uint num3 = Models[(IntPtr) (startIndex + num1)].Decode(rangeDecoder);
+        num1 = (num1 << 1) + num3;
+        num2 |= num3 << index;
+      }
+      return num2;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/RangeCoder/BitTreeEncoder.cs

@@ -0,0 +1,117 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitTreeEncoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitTreeEncoder
+  {
+    private BitEncoder[] Models;
+    private int NumBitLevels;
+
+    public BitTreeEncoder(int numBitLevels)
+    {
+      this.NumBitLevels = numBitLevels;
+      this.Models = new BitEncoder[1 << numBitLevels];
+    }
+
+    public void Init()
+    {
+      for (uint index = 1; (long) index < (long) (1 << this.NumBitLevels); ++index)
+        this.Models[(IntPtr) index].Init();
+    }
+
+    public void Encode(Encoder rangeEncoder, uint symbol)
+    {
+      uint index = 1;
+      int numBitLevels = this.NumBitLevels;
+      while (numBitLevels > 0)
+      {
+        --numBitLevels;
+        uint symbol1 = symbol >> numBitLevels & 1U;
+        this.Models[(IntPtr) index].Encode(rangeEncoder, symbol1);
+        index = index << 1 | symbol1;
+      }
+    }
+
+    public void ReverseEncode(Encoder rangeEncoder, uint symbol)
+    {
+      uint index1 = 1;
+      for (uint index2 = 0; (long) index2 < (long) this.NumBitLevels; ++index2)
+      {
+        uint symbol1 = symbol & 1U;
+        this.Models[(IntPtr) index1].Encode(rangeEncoder, symbol1);
+        index1 = index1 << 1 | symbol1;
+        symbol >>= 1;
+      }
+    }
+
+    public uint GetPrice(uint symbol)
+    {
+      uint price = 0;
+      uint index = 1;
+      int numBitLevels = this.NumBitLevels;
+      while (numBitLevels > 0)
+      {
+        --numBitLevels;
+        uint symbol1 = symbol >> numBitLevels & 1U;
+        price += this.Models[(IntPtr) index].GetPrice(symbol1);
+        index = (index << 1) + symbol1;
+      }
+      return price;
+    }
+
+    public uint ReverseGetPrice(uint symbol)
+    {
+      uint price = 0;
+      uint index = 1;
+      for (int numBitLevels = this.NumBitLevels; numBitLevels > 0; --numBitLevels)
+      {
+        uint symbol1 = symbol & 1U;
+        symbol >>= 1;
+        price += this.Models[(IntPtr) index].GetPrice(symbol1);
+        index = index << 1 | symbol1;
+      }
+      return price;
+    }
+
+    public static uint ReverseGetPrice(
+      BitEncoder[] Models,
+      uint startIndex,
+      int NumBitLevels,
+      uint symbol)
+    {
+      uint price = 0;
+      uint num = 1;
+      for (int index = NumBitLevels; index > 0; --index)
+      {
+        uint symbol1 = symbol & 1U;
+        symbol >>= 1;
+        price += Models[(IntPtr) (startIndex + num)].GetPrice(symbol1);
+        num = num << 1 | symbol1;
+      }
+      return price;
+    }
+
+    public static void ReverseEncode(
+      BitEncoder[] Models,
+      uint startIndex,
+      Encoder rangeEncoder,
+      int NumBitLevels,
+      uint symbol)
+    {
+      uint num = 1;
+      for (int index = 0; index < NumBitLevels; ++index)
+      {
+        uint symbol1 = symbol & 1U;
+        Models[(IntPtr) (startIndex + num)].Encode(rangeEncoder, symbol1);
+        num = num << 1 | symbol1;
+        symbol >>= 1;
+      }
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/RangeCoder/Decoder.cs

@@ -0,0 +1,95 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.Decoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System.IO;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal class Decoder
+  {
+    public const uint kTopValue = 16777216;
+    public uint Range;
+    public uint Code;
+    public Stream Stream;
+
+    public void Init(Stream stream)
+    {
+      this.Stream = stream;
+      this.Code = 0U;
+      this.Range = uint.MaxValue;
+      for (int index = 0; index < 5; ++index)
+        this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
+    }
+
+    public void ReleaseStream() => this.Stream = (Stream) null;
+
+    public void CloseStream() => this.Stream.Close();
+
+    public void Normalize()
+    {
+      for (; this.Range < 16777216U; this.Range <<= 8)
+        this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
+    }
+
+    public void Normalize2()
+    {
+      if (this.Range >= 16777216U)
+        return;
+      this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
+      this.Range <<= 8;
+    }
+
+    public uint GetThreshold(uint total) => this.Code / (this.Range /= total);
+
+    public void Decode(uint start, uint size, uint total)
+    {
+      this.Code -= start * this.Range;
+      this.Range *= size;
+      this.Normalize();
+    }
+
+    public uint DecodeDirectBits(int numTotalBits)
+    {
+      uint range = this.Range;
+      uint num1 = this.Code;
+      uint num2 = 0;
+      for (int index = numTotalBits; index > 0; --index)
+      {
+        range >>= 1;
+        uint num3 = num1 - range >> 31;
+        num1 -= range & num3 - 1U;
+        num2 = (uint) ((int) num2 << 1 | 1 - (int) num3);
+        if (range < 16777216U)
+        {
+          num1 = num1 << 8 | (uint) (byte) this.Stream.ReadByte();
+          range <<= 8;
+        }
+      }
+      this.Range = range;
+      this.Code = num1;
+      return num2;
+    }
+
+    public uint DecodeBit(uint size0, int numTotalBits)
+    {
+      uint num1 = (this.Range >> numTotalBits) * size0;
+      uint num2;
+      if (this.Code < num1)
+      {
+        num2 = 0U;
+        this.Range = num1;
+      }
+      else
+      {
+        num2 = 1U;
+        this.Code -= num1;
+        this.Range -= num1;
+      }
+      this.Normalize();
+      return num2;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Compression/RangeCoder/Encoder.cs

@@ -0,0 +1,108 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.Encoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System.IO;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal class Encoder
+  {
+    public const uint kTopValue = 16777216;
+    private Stream Stream;
+    public ulong Low;
+    public uint Range;
+    private uint _cacheSize;
+    private byte _cache;
+    private long StartPosition;
+
+    public void SetStream(Stream stream) => this.Stream = stream;
+
+    public void ReleaseStream() => this.Stream = (Stream) null;
+
+    public void Init()
+    {
+      this.StartPosition = this.Stream.Position;
+      this.Low = 0UL;
+      this.Range = uint.MaxValue;
+      this._cacheSize = 1U;
+      this._cache = (byte) 0;
+    }
+
+    public void FlushData()
+    {
+      for (int index = 0; index < 5; ++index)
+        this.ShiftLow();
+    }
+
+    public void FlushStream() => this.Stream.Flush();
+
+    public void CloseStream() => this.Stream.Close();
+
+    public void Encode(uint start, uint size, uint total)
+    {
+      this.Low += (ulong) (start * (this.Range /= total));
+      this.Range *= size;
+      while (this.Range < 16777216U)
+      {
+        this.Range <<= 8;
+        this.ShiftLow();
+      }
+    }
+
+    public void ShiftLow()
+    {
+      if ((uint) this.Low < 4278190080U || (uint) (this.Low >> 32) == 1U)
+      {
+        byte num = this._cache;
+        do
+        {
+          this.Stream.WriteByte((byte) ((ulong) num + (this.Low >> 32)));
+          num = byte.MaxValue;
+        }
+        while (--this._cacheSize != 0U);
+        this._cache = (byte) ((uint) this.Low >> 24);
+      }
+      ++this._cacheSize;
+      this.Low = (ulong) ((uint) this.Low << 8);
+    }
+
+    public void EncodeDirectBits(uint v, int numTotalBits)
+    {
+      for (int index = numTotalBits - 1; index >= 0; --index)
+      {
+        this.Range >>= 1;
+        if (((int) (v >> index) & 1) == 1)
+          this.Low += (ulong) this.Range;
+        if (this.Range < 16777216U)
+        {
+          this.Range <<= 8;
+          this.ShiftLow();
+        }
+      }
+    }
+
+    public void EncodeBit(uint size0, int numTotalBits, uint symbol)
+    {
+      uint num = (this.Range >> numTotalBits) * size0;
+      if (symbol == 0U)
+      {
+        this.Range = num;
+      }
+      else
+      {
+        this.Low += (ulong) num;
+        this.Range -= num;
+      }
+      while (this.Range < 16777216U)
+      {
+        this.Range <<= 8;
+        this.ShiftLow();
+      }
+    }
+
+    public long GetProcessedSizeAdd() => (long) this._cacheSize + this.Stream.Position - this.StartPosition + 4L;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/DataErrorException.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.DataErrorException
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+
+namespace SevenZip
+{
+  internal class DataErrorException : ApplicationException
+  {
+    public DataErrorException()
+      : base("Data Error")
+    {
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/ICodeProgress.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ICodeProgress
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip
+{
+  public interface ICodeProgress
+  {
+    void SetProgress(long inSize, long outSize);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/ICoder.cs

@@ -0,0 +1,20 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ICoder
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System.IO;
+
+namespace SevenZip
+{
+  public interface ICoder
+  {
+    void Code(
+      Stream inStream,
+      Stream outStream,
+      long inSize,
+      long outSize,
+      ICodeProgress progress);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/ISetCoderProperties.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ISetCoderProperties
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip
+{
+  public interface ISetCoderProperties
+  {
+    void SetCoderProperties(CoderPropID[] propIDs, object[] properties);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/ISetDecoderProperties.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ISetDecoderProperties
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+namespace SevenZip
+{
+  public interface ISetDecoderProperties
+  {
+    void SetDecoderProperties(byte[] properties);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/IWriteCoderProperties.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.IWriteCoderProperties
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System.IO;
+
+namespace SevenZip
+{
+  public interface IWriteCoderProperties
+  {
+    void WriteCoderProperties(Stream outStream);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/InvalidParamException.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.InvalidParamException
+// Assembly: P4CTEMP, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 7BE4E538-8555-4C2E-974B-99E556F5462C
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe
+
+using System;
+
+namespace SevenZip
+{
+  internal class InvalidParamException : ApplicationException
+  {
+    public InvalidParamException()
+      : base("Invalid Parameter")
+    {
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Trojan-Ransom.Win32.Gimemo.ayt.csproj

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{DD3E6800-B909-442C-AB98-F8DB5B0B2E96}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>P4CTEMP</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>SevenZip</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="DataErrorException.cs" />
+    <Compile Include="InvalidParamException.cs" />
+    <Compile Include="ICodeProgress.cs" />
+    <Compile Include="ICoder.cs" />
+    <Compile Include="CoderPropID.cs" />
+    <Compile Include="ISetCoderProperties.cs" />
+    <Compile Include="IWriteCoderProperties.cs" />
+    <Compile Include="ISetDecoderProperties.cs" />
+    <Compile Include="CRC.cs" />
+    <Compile Include="Buffer\InBuffer.cs" />
+    <Compile Include="Buffer\OutBuffer.cs" />
+    <Compile Include="Compression\LZ\IInWindowStream.cs" />
+    <Compile Include="Compression\LZ\IMatchFinder.cs" />
+    <Compile Include="Compression\LZ\InWindow.cs" />
+    <Compile Include="Compression\LZ\BinTree.cs" />
+    <Compile Include="Compression\LZ\OutWindow.cs" />
+    <Compile Include="Compression\LZMA\Base.cs" />
+    <Compile Include="Compression\LZMA\Decoder.cs" />
+    <Compile Include="Compression\LZMA\Encoder.cs" />
+    <Compile Include="Compression\LZMA\SevenZipHelper.cs" />
+    <Compile Include="Compression\RangeCoder\Encoder.cs" />
+    <Compile Include="Compression\RangeCoder\Decoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitEncoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitDecoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitTreeEncoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitTreeDecoder.cs" />
+    <Compile Include="SysDriver\Driver.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="temp.resource" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5/Trojan-Ransom.Win32.Gimemo.ayt.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "P4CTEMP", "Trojan-Ransom.Win32.Gimemo.ayt-624a52079bf1703bcd3bcc9d2d3716b6126fd05655e25289d19142f9aae02eb5.csproj", "{DD3E6800-B909-442C-AB98-F8DB5B0B2E96}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{DD3E6800-B909-442C-AB98-F8DB5B0B2E96}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{DD3E6800-B909-442C-AB98-F8DB5B0B2E96}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{DD3E6800-B909-442C-AB98-F8DB5B0B2E96}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{DD3E6800-B909-442C-AB98-F8DB5B0B2E96}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/AssemblyInfo.cs

@@ -0,0 +1,15 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security.Permissions;
+
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCopyright("")]
+[assembly: AssemblyProduct("")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyTitle("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Buffer/InBuffer.cs

@@ -0,0 +1,63 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Buffer.InBuffer
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Buffer
+{
+  public class InBuffer
+  {
+    private byte[] m_Buffer;
+    private uint m_Pos;
+    private uint m_Limit;
+    private uint m_BufferSize;
+    private Stream m_Stream;
+    private bool m_StreamWasExhausted;
+    private ulong m_ProcessedSize;
+
+    public InBuffer(uint bufferSize)
+    {
+      this.m_Buffer = new byte[(IntPtr) bufferSize];
+      this.m_BufferSize = bufferSize;
+    }
+
+    public void Init(Stream stream)
+    {
+      this.m_Stream = stream;
+      this.m_ProcessedSize = 0UL;
+      this.m_Limit = 0U;
+      this.m_Pos = 0U;
+      this.m_StreamWasExhausted = false;
+    }
+
+    public bool ReadBlock()
+    {
+      if (this.m_StreamWasExhausted)
+        return false;
+      this.m_ProcessedSize += (ulong) this.m_Pos;
+      int num = this.m_Stream.Read(this.m_Buffer, 0, (int) this.m_BufferSize);
+      this.m_Pos = 0U;
+      this.m_Limit = (uint) num;
+      this.m_StreamWasExhausted = num == 0;
+      return !this.m_StreamWasExhausted;
+    }
+
+    public void ReleaseStream() => this.m_Stream = (Stream) null;
+
+    public bool ReadByte(byte b)
+    {
+      if (this.m_Pos >= this.m_Limit && !this.ReadBlock())
+        return false;
+      b = this.m_Buffer[(IntPtr) this.m_Pos++];
+      return true;
+    }
+
+    public byte ReadByte() => this.m_Pos >= this.m_Limit && !this.ReadBlock() ? byte.MaxValue : this.m_Buffer[(IntPtr) this.m_Pos++];
+
+    public ulong GetProcessedSize() => this.m_ProcessedSize + (ulong) this.m_Pos;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Buffer/OutBuffer.cs

@@ -0,0 +1,58 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Buffer.OutBuffer
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Buffer
+{
+  public class OutBuffer
+  {
+    private byte[] m_Buffer;
+    private uint m_Pos;
+    private uint m_BufferSize;
+    private Stream m_Stream;
+    private ulong m_ProcessedSize;
+
+    public OutBuffer(uint bufferSize)
+    {
+      this.m_Buffer = new byte[(IntPtr) bufferSize];
+      this.m_BufferSize = bufferSize;
+    }
+
+    public void SetStream(Stream stream) => this.m_Stream = stream;
+
+    public void FlushStream() => this.m_Stream.Flush();
+
+    public void CloseStream() => this.m_Stream.Close();
+
+    public void ReleaseStream() => this.m_Stream = (Stream) null;
+
+    public void Init()
+    {
+      this.m_ProcessedSize = 0UL;
+      this.m_Pos = 0U;
+    }
+
+    public void WriteByte(byte b)
+    {
+      this.m_Buffer[(IntPtr) this.m_Pos++] = b;
+      if (this.m_Pos < this.m_BufferSize)
+        return;
+      this.FlushData();
+    }
+
+    public void FlushData()
+    {
+      if (this.m_Pos == 0U)
+        return;
+      this.m_Stream.Write(this.m_Buffer, 0, (int) this.m_Pos);
+      this.m_Pos = 0U;
+    }
+
+    public ulong GetProcessedSize() => this.m_ProcessedSize + (ulong) this.m_Pos;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/CRC.cs

@@ -0,0 +1,53 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.CRC
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+
+namespace SevenZip
+{
+  internal class CRC
+  {
+    public static readonly uint[] Table = new uint[256];
+    private uint _value = uint.MaxValue;
+
+    static CRC()
+    {
+      for (uint index1 = 0; index1 < 256U; ++index1)
+      {
+        uint num = index1;
+        for (int index2 = 0; index2 < 8; ++index2)
+        {
+          if (((int) num & 1) != 0)
+            num = num >> 1 ^ 3988292384U;
+          else
+            num >>= 1;
+        }
+        CRC.Table[(IntPtr) index1] = num;
+      }
+    }
+
+    public void Init() => this._value = uint.MaxValue;
+
+    public void UpdateByte(byte b) => this._value = CRC.Table[(int) (byte) this._value ^ (int) b] ^ this._value >> 8;
+
+    public void Update(byte[] data, uint offset, uint size)
+    {
+      for (uint index = 0; index < size; ++index)
+        this._value = CRC.Table[(int) (byte) this._value ^ (int) data[(IntPtr) (offset + index)]] ^ this._value >> 8;
+    }
+
+    public uint GetDigest() => this._value ^ uint.MaxValue;
+
+    private static uint CalculateDigest(byte[] data, uint offset, uint size)
+    {
+      CRC crc = new CRC();
+      crc.Update(data, offset, size);
+      return crc.GetDigest();
+    }
+
+    private static bool VerifyDigest(uint digest, byte[] data, uint offset, uint size) => (int) CRC.CalculateDigest(data, offset, size) == (int) digest;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/CoderPropID.cs

@@ -0,0 +1,27 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.CoderPropID
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip
+{
+  public enum CoderPropID
+  {
+    DefaultProp,
+    DictionarySize,
+    UsedMemorySize,
+    Order,
+    BlockSize,
+    PosStateBits,
+    LitContextBits,
+    LitPosBits,
+    NumFastBytes,
+    MatchFinder,
+    MatchFinderCycles,
+    NumPasses,
+    Algorithm,
+    NumThreads,
+    EndMarker,
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZ/BinTree.cs

@@ -0,0 +1,370 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.BinTree
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  public class BinTree : InWindow, IMatchFinder, IInWindowStream
+  {
+    private const uint kHash2Size = 1024;
+    private const uint kHash3Size = 65536;
+    private const uint kBT2HashSize = 65536;
+    private const uint kStartMaxLen = 1;
+    private const uint kHash3Offset = 1024;
+    private const uint kEmptyHashValue = 0;
+    private const uint kMaxValForNormalize = 2147483647;
+    private uint _cyclicBufferPos;
+    private uint _cyclicBufferSize;
+    private uint _matchMaxLen;
+    private uint[] _son;
+    private uint[] _hash;
+    private uint _cutValue = (uint) byte.MaxValue;
+    private uint _hashMask;
+    private uint _hashSizeSum;
+    private bool HASH_ARRAY = true;
+    private uint kNumHashDirectBytes;
+    private uint kMinMatchCheck = 4;
+    private uint kFixHashSize = 66560;
+
+    public void SetType(int numHashBytes)
+    {
+      this.HASH_ARRAY = numHashBytes > 2;
+      if (this.HASH_ARRAY)
+      {
+        this.kNumHashDirectBytes = 0U;
+        this.kMinMatchCheck = 4U;
+        this.kFixHashSize = 66560U;
+      }
+      else
+      {
+        this.kNumHashDirectBytes = 2U;
+        this.kMinMatchCheck = 3U;
+        this.kFixHashSize = 0U;
+      }
+    }
+
+    public new void SetStream(Stream stream) => base.SetStream(stream);
+
+    public new void ReleaseStream() => base.ReleaseStream();
+
+    public new void Init()
+    {
+      base.Init();
+      for (uint index = 0; index < this._hashSizeSum; ++index)
+        this._hash[(IntPtr) index] = 0U;
+      this._cyclicBufferPos = 0U;
+      this.ReduceOffsets(-1);
+    }
+
+    public new void MovePos()
+    {
+      if (++this._cyclicBufferPos >= this._cyclicBufferSize)
+        this._cyclicBufferPos = 0U;
+      base.MovePos();
+      if (this._pos != (uint) int.MaxValue)
+        return;
+      this.Normalize();
+    }
+
+    public new byte GetIndexByte(int index) => base.GetIndexByte(index);
+
+    public new uint GetMatchLen(int index, uint distance, uint limit) => base.GetMatchLen(index, distance, limit);
+
+    public new uint GetNumAvailableBytes() => base.GetNumAvailableBytes();
+
+    public void Create(
+      uint historySize,
+      uint keepAddBufferBefore,
+      uint matchMaxLen,
+      uint keepAddBufferAfter)
+    {
+      if (historySize > 2147483391U)
+        throw new Exception();
+      this._cutValue = 16U + (matchMaxLen >> 1);
+      uint keepSizeReserv = (historySize + keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2U + 256U;
+      this.Create(historySize + keepAddBufferBefore, matchMaxLen + keepAddBufferAfter, keepSizeReserv);
+      this._matchMaxLen = matchMaxLen;
+      uint num1 = historySize + 1U;
+      if ((int) this._cyclicBufferSize != (int) num1)
+        this._son = new uint[(IntPtr) ((this._cyclicBufferSize = num1) * 2U)];
+      uint num2 = 65536;
+      if (this.HASH_ARRAY)
+      {
+        uint num3 = historySize - 1U;
+        uint num4 = num3 | num3 >> 1;
+        uint num5 = num4 | num4 >> 2;
+        uint num6 = num5 | num5 >> 4;
+        uint num7 = (num6 | num6 >> 8) >> 1 | (uint) ushort.MaxValue;
+        if (num7 > 16777216U)
+          num7 >>= 1;
+        this._hashMask = num7;
+        num2 = num7 + 1U + this.kFixHashSize;
+      }
+      if ((int) num2 == (int) this._hashSizeSum)
+        return;
+      this._hash = new uint[(IntPtr) (this._hashSizeSum = num2)];
+    }
+
+    public uint GetMatches(uint[] distances)
+    {
+      uint num1;
+      if (this._pos + this._matchMaxLen <= this._streamPos)
+      {
+        num1 = this._matchMaxLen;
+      }
+      else
+      {
+        num1 = this._streamPos - this._pos;
+        if (num1 < this.kMinMatchCheck)
+        {
+          this.MovePos();
+          return 0;
+        }
+      }
+      uint matches = 0;
+      uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
+      uint index1 = this._bufferOffset + this._pos;
+      uint num3 = 1;
+      uint index2 = 0;
+      uint num4 = 0;
+      uint num5;
+      if (this.HASH_ARRAY)
+      {
+        uint num6 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
+        index2 = num6 & 1023U;
+        uint num7 = num6 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
+        num4 = num7 & (uint) ushort.MaxValue;
+        num5 = (num7 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
+      }
+      else
+        num5 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
+      uint num8 = this._hash[(IntPtr) (this.kFixHashSize + num5)];
+      if (this.HASH_ARRAY)
+      {
+        uint num9 = this._hash[(IntPtr) index2];
+        uint num10 = this._hash[(IntPtr) (1024U + num4)];
+        this._hash[(IntPtr) index2] = this._pos;
+        this._hash[(IntPtr) (1024U + num4)] = this._pos;
+        if (num9 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num9)] == (int) this._bufferBase[(IntPtr) index1])
+        {
+          uint[] numArray1 = distances;
+          int num11 = (int) matches;
+          uint num12 = (uint) (num11 + 1);
+          uint index3 = (uint) num11;
+          int num13;
+          num3 = (uint) (num13 = 2);
+          numArray1[(IntPtr) index3] = (uint) num13;
+          uint[] numArray2 = distances;
+          int num14 = (int) num12;
+          matches = (uint) (num14 + 1);
+          uint index4 = (uint) num14;
+          int num15 = (int) this._pos - (int) num9 - 1;
+          numArray2[(IntPtr) index4] = (uint) num15;
+        }
+        if (num10 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num10)] == (int) this._bufferBase[(IntPtr) index1])
+        {
+          if ((int) num10 == (int) num9)
+            matches -= 2U;
+          uint[] numArray3 = distances;
+          int num16 = (int) matches;
+          uint num17 = (uint) (num16 + 1);
+          uint index5 = (uint) num16;
+          int num18;
+          num3 = (uint) (num18 = 3);
+          numArray3[(IntPtr) index5] = (uint) num18;
+          uint[] numArray4 = distances;
+          int num19 = (int) num17;
+          matches = (uint) (num19 + 1);
+          uint index6 = (uint) num19;
+          int num20 = (int) this._pos - (int) num10 - 1;
+          numArray4[(IntPtr) index6] = (uint) num20;
+          num9 = num10;
+        }
+        if (matches != 0U && (int) num9 == (int) num8)
+        {
+          matches -= 2U;
+          num3 = 1U;
+        }
+      }
+      this._hash[(IntPtr) (this.kFixHashSize + num5)] = this._pos;
+      uint index7 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
+      uint index8 = this._cyclicBufferPos << 1;
+      uint val2;
+      uint val1 = val2 = this.kNumHashDirectBytes;
+      if (this.kNumHashDirectBytes != 0U && num8 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num8 + this.kNumHashDirectBytes)] != (int) this._bufferBase[(IntPtr) (index1 + this.kNumHashDirectBytes)])
+      {
+        uint[] numArray5 = distances;
+        int num21 = (int) matches;
+        uint num22 = (uint) (num21 + 1);
+        uint index9 = (uint) num21;
+        int numHashDirectBytes;
+        num3 = (uint) (numHashDirectBytes = (int) this.kNumHashDirectBytes);
+        numArray5[(IntPtr) index9] = (uint) numHashDirectBytes;
+        uint[] numArray6 = distances;
+        int num23 = (int) num22;
+        matches = (uint) (num23 + 1);
+        uint index10 = (uint) num23;
+        int num24 = (int) this._pos - (int) num8 - 1;
+        numArray6[(IntPtr) index10] = (uint) num24;
+      }
+      uint cutValue = this._cutValue;
+      while (num8 > num2 && cutValue-- != 0U)
+      {
+        uint num25 = this._pos - num8;
+        uint index11 = (uint) ((num25 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num25 : (int) this._cyclicBufferPos - (int) num25 + (int) this._cyclicBufferSize) << 1);
+        uint num26 = this._bufferOffset + num8;
+        uint num27 = Math.Min(val1, val2);
+        if ((int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)])
+        {
+          do
+            ;
+          while ((int) ++num27 != (int) num1 && (int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)]);
+          if (num3 < num27)
+          {
+            uint[] numArray7 = distances;
+            int num28 = (int) matches;
+            uint num29 = (uint) (num28 + 1);
+            uint index12 = (uint) num28;
+            int num30;
+            num3 = (uint) (num30 = (int) num27);
+            numArray7[(IntPtr) index12] = (uint) num30;
+            uint[] numArray8 = distances;
+            int num31 = (int) num29;
+            matches = (uint) (num31 + 1);
+            uint index13 = (uint) num31;
+            int num32 = (int) num25 - 1;
+            numArray8[(IntPtr) index13] = (uint) num32;
+            if ((int) num27 == (int) num1)
+            {
+              this._son[(IntPtr) index8] = this._son[(IntPtr) index11];
+              this._son[(IntPtr) index7] = this._son[(IntPtr) (index11 + 1U)];
+              goto label_29;
+            }
+          }
+        }
+        if ((int) this._bufferBase[(IntPtr) (num26 + num27)] < (int) this._bufferBase[(IntPtr) (index1 + num27)])
+        {
+          this._son[(IntPtr) index8] = num8;
+          index8 = index11 + 1U;
+          num8 = this._son[(IntPtr) index8];
+          val2 = num27;
+        }
+        else
+        {
+          this._son[(IntPtr) index7] = num8;
+          index7 = index11;
+          num8 = this._son[(IntPtr) index7];
+          val1 = num27;
+        }
+      }
+      this._son[(IntPtr) index7] = this._son[(IntPtr) index8] = 0U;
+label_29:
+      this.MovePos();
+      return matches;
+    }
+
+    public void Skip(uint num)
+    {
+      do
+      {
+        uint num1;
+        if (this._pos + this._matchMaxLen <= this._streamPos)
+        {
+          num1 = this._matchMaxLen;
+        }
+        else
+        {
+          num1 = this._streamPos - this._pos;
+          if (num1 < this.kMinMatchCheck)
+          {
+            this.MovePos();
+            goto label_19;
+          }
+        }
+        uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
+        uint index1 = this._bufferOffset + this._pos;
+        uint num3;
+        if (this.HASH_ARRAY)
+        {
+          uint num4 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
+          this._hash[(IntPtr) (num4 & 1023U)] = this._pos;
+          uint num5 = num4 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
+          this._hash[(IntPtr) (1024U + (num5 & (uint) ushort.MaxValue))] = this._pos;
+          num3 = (num5 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
+        }
+        else
+          num3 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
+        uint num6 = this._hash[(IntPtr) (this.kFixHashSize + num3)];
+        this._hash[(IntPtr) (this.kFixHashSize + num3)] = this._pos;
+        uint index2 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
+        uint index3 = this._cyclicBufferPos << 1;
+        uint val2;
+        uint val1 = val2 = this.kNumHashDirectBytes;
+        uint cutValue = this._cutValue;
+        while (num6 > num2 && cutValue-- != 0U)
+        {
+          uint num7 = this._pos - num6;
+          uint index4 = (uint) ((num7 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num7 : (int) this._cyclicBufferPos - (int) num7 + (int) this._cyclicBufferSize) << 1);
+          uint num8 = this._bufferOffset + num6;
+          uint num9 = Math.Min(val1, val2);
+          if ((int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)])
+          {
+            do
+              ;
+            while ((int) ++num9 != (int) num1 && (int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)]);
+            if ((int) num9 == (int) num1)
+            {
+              this._son[(IntPtr) index3] = this._son[(IntPtr) index4];
+              this._son[(IntPtr) index2] = this._son[(IntPtr) (index4 + 1U)];
+              goto label_18;
+            }
+          }
+          if ((int) this._bufferBase[(IntPtr) (num8 + num9)] < (int) this._bufferBase[(IntPtr) (index1 + num9)])
+          {
+            this._son[(IntPtr) index3] = num6;
+            index3 = index4 + 1U;
+            num6 = this._son[(IntPtr) index3];
+            val2 = num9;
+          }
+          else
+          {
+            this._son[(IntPtr) index2] = num6;
+            index2 = index4;
+            num6 = this._son[(IntPtr) index2];
+            val1 = num9;
+          }
+        }
+        this._son[(IntPtr) index2] = this._son[(IntPtr) index3] = 0U;
+label_18:
+        this.MovePos();
+label_19:;
+      }
+      while (--num != 0U);
+    }
+
+    private void NormalizeLinks(uint[] items, uint numItems, uint subValue)
+    {
+      for (uint index = 0; index < numItems; ++index)
+      {
+        uint num1 = items[(IntPtr) index];
+        uint num2 = num1 > subValue ? num1 - subValue : 0U;
+        items[(IntPtr) index] = num2;
+      }
+    }
+
+    private void Normalize()
+    {
+      uint subValue = this._pos - this._cyclicBufferSize;
+      this.NormalizeLinks(this._son, this._cyclicBufferSize * 2U, subValue);
+      this.NormalizeLinks(this._hash, this._hashSizeSum, subValue);
+      this.ReduceOffsets((int) subValue);
+    }
+
+    public void SetCutValue(uint cutValue) => this._cutValue = cutValue;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZ/IInWindowStream.cs

@@ -0,0 +1,25 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.IInWindowStream
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  internal interface IInWindowStream
+  {
+    void SetStream(Stream inStream);
+
+    void Init();
+
+    void ReleaseStream();
+
+    byte GetIndexByte(int index);
+
+    uint GetMatchLen(int index, uint distance, uint limit);
+
+    uint GetNumAvailableBytes();
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZ/IMatchFinder.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.IMatchFinder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip.Compression.LZ
+{
+  internal interface IMatchFinder : IInWindowStream
+  {
+    void Create(
+      uint historySize,
+      uint keepAddBufferBefore,
+      uint matchMaxLen,
+      uint keepAddBufferAfter);
+
+    uint GetMatches(uint[] distances);
+
+    void Skip(uint num);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZ/InWindow.cs

@@ -0,0 +1,127 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.InWindow
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  public class InWindow
+  {
+    public byte[] _bufferBase;
+    private Stream _stream;
+    private uint _posLimit;
+    private bool _streamEndWasReached;
+    private uint _pointerToLastSafePosition;
+    public uint _bufferOffset;
+    public uint _blockSize;
+    public uint _pos;
+    private uint _keepSizeBefore;
+    private uint _keepSizeAfter;
+    public uint _streamPos;
+
+    public void MoveBlock()
+    {
+      uint num1 = this._bufferOffset + this._pos - this._keepSizeBefore;
+      if (num1 > 0U)
+        --num1;
+      uint num2 = this._bufferOffset + this._streamPos - num1;
+      for (uint index = 0; index < num2; ++index)
+        this._bufferBase[(IntPtr) index] = this._bufferBase[(IntPtr) (num1 + index)];
+      this._bufferOffset -= num1;
+    }
+
+    public virtual void ReadBlock()
+    {
+      if (this._streamEndWasReached)
+        return;
+      while (true)
+      {
+        do
+        {
+          int count = -(int) this._bufferOffset + (int) this._blockSize - (int) this._streamPos;
+          if (count == 0)
+            return;
+          int num = this._stream.Read(this._bufferBase, (int) this._bufferOffset + (int) this._streamPos, count);
+          if (num == 0)
+          {
+            this._posLimit = this._streamPos;
+            if (this._bufferOffset + this._posLimit > this._pointerToLastSafePosition)
+              this._posLimit = this._pointerToLastSafePosition - this._bufferOffset;
+            this._streamEndWasReached = true;
+            return;
+          }
+          this._streamPos += (uint) num;
+        }
+        while (this._streamPos < this._pos + this._keepSizeAfter);
+        this._posLimit = this._streamPos - this._keepSizeAfter;
+      }
+    }
+
+    private void Free() => this._bufferBase = (byte[]) null;
+
+    public void Create(uint keepSizeBefore, uint keepSizeAfter, uint keepSizeReserv)
+    {
+      this._keepSizeBefore = keepSizeBefore;
+      this._keepSizeAfter = keepSizeAfter;
+      uint num = keepSizeBefore + keepSizeAfter + keepSizeReserv;
+      if (this._bufferBase == null || (int) this._blockSize != (int) num)
+      {
+        this.Free();
+        this._blockSize = num;
+        this._bufferBase = new byte[(IntPtr) this._blockSize];
+      }
+      this._pointerToLastSafePosition = this._blockSize - keepSizeAfter;
+    }
+
+    public void SetStream(Stream stream) => this._stream = stream;
+
+    public void ReleaseStream() => this._stream = (Stream) null;
+
+    public void Init()
+    {
+      this._bufferOffset = 0U;
+      this._pos = 0U;
+      this._streamPos = 0U;
+      this._streamEndWasReached = false;
+      this.ReadBlock();
+    }
+
+    public void MovePos()
+    {
+      ++this._pos;
+      if (this._pos <= this._posLimit)
+        return;
+      if (this._bufferOffset + this._pos > this._pointerToLastSafePosition)
+        this.MoveBlock();
+      this.ReadBlock();
+    }
+
+    public byte GetIndexByte(int index) => this._bufferBase[(long) (this._bufferOffset + this._pos) + (long) index];
+
+    public uint GetMatchLen(int index, uint distance, uint limit)
+    {
+      if (this._streamEndWasReached && (long) this._pos + (long) index + (long) limit > (long) this._streamPos)
+        limit = this._streamPos - (uint) ((ulong) this._pos + (ulong) index);
+      ++distance;
+      uint num = (uint) ((int) this._bufferOffset + (int) this._pos + index);
+      uint matchLen = 0;
+      while (matchLen < limit && (int) this._bufferBase[(IntPtr) (num + matchLen)] == (int) this._bufferBase[(IntPtr) (num + matchLen - distance)])
+        ++matchLen;
+      return matchLen;
+    }
+
+    public uint GetNumAvailableBytes() => this._streamPos - this._pos;
+
+    public void ReduceOffsets(int subValue)
+    {
+      this._bufferOffset += (uint) subValue;
+      this._posLimit -= (uint) subValue;
+      this._pos -= (uint) subValue;
+      this._streamPos -= (uint) subValue;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZ/OutWindow.cs

@@ -0,0 +1,113 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZ.OutWindow
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZ
+{
+  public class OutWindow
+  {
+    private byte[] _buffer;
+    private uint _pos;
+    private uint _windowSize;
+    private uint _streamPos;
+    private Stream _stream;
+    public uint TrainSize;
+
+    public void Create(uint windowSize)
+    {
+      if ((int) this._windowSize != (int) windowSize)
+        this._buffer = new byte[(IntPtr) windowSize];
+      this._windowSize = windowSize;
+      this._pos = 0U;
+      this._streamPos = 0U;
+    }
+
+    public void Init(Stream stream, bool solid)
+    {
+      this.ReleaseStream();
+      this._stream = stream;
+      if (solid)
+        return;
+      this._streamPos = 0U;
+      this._pos = 0U;
+      this.TrainSize = 0U;
+    }
+
+    public bool Train(Stream stream)
+    {
+      long length = stream.Length;
+      uint num1 = length < (long) this._windowSize ? (uint) length : this._windowSize;
+      this.TrainSize = num1;
+      stream.Position = length - (long) num1;
+      this._streamPos = this._pos = 0U;
+      while (num1 > 0U)
+      {
+        uint count = this._windowSize - this._pos;
+        if (num1 < count)
+          count = num1;
+        int num2 = stream.Read(this._buffer, (int) this._pos, (int) count);
+        if (num2 == 0)
+          return false;
+        num1 -= (uint) num2;
+        this._pos += (uint) num2;
+        this._streamPos += (uint) num2;
+        if ((int) this._pos == (int) this._windowSize)
+          this._streamPos = this._pos = 0U;
+      }
+      return true;
+    }
+
+    public void ReleaseStream()
+    {
+      this.Flush();
+      this._stream = (Stream) null;
+    }
+
+    public void Flush()
+    {
+      uint count = this._pos - this._streamPos;
+      if (count == 0U)
+        return;
+      this._stream.Write(this._buffer, (int) this._streamPos, (int) count);
+      if (this._pos >= this._windowSize)
+        this._pos = 0U;
+      this._streamPos = this._pos;
+    }
+
+    public void CopyBlock(uint distance, uint len)
+    {
+      uint num = (uint) ((int) this._pos - (int) distance - 1);
+      if (num >= this._windowSize)
+        num += this._windowSize;
+      for (; len > 0U; --len)
+      {
+        if (num >= this._windowSize)
+          num = 0U;
+        this._buffer[(IntPtr) this._pos++] = this._buffer[(IntPtr) num++];
+        if (this._pos >= this._windowSize)
+          this.Flush();
+      }
+    }
+
+    public void PutByte(byte b)
+    {
+      this._buffer[(IntPtr) this._pos++] = b;
+      if (this._pos < this._windowSize)
+        return;
+      this.Flush();
+    }
+
+    public byte GetByte(uint distance)
+    {
+      uint index = (uint) ((int) this._pos - (int) distance - 1);
+      if (index >= this._windowSize)
+        index += this._windowSize;
+      return this._buffer[(IntPtr) index];
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZMA/Base.cs

@@ -0,0 +1,70 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZMA.Base
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip.Compression.LZMA
+{
+  internal abstract class Base
+  {
+    public const uint kNumRepDistances = 4;
+    public const uint kNumStates = 12;
+    public const int kNumPosSlotBits = 6;
+    public const int kDicLogSizeMin = 0;
+    public const int kNumLenToPosStatesBits = 2;
+    public const uint kNumLenToPosStates = 4;
+    public const uint kMatchMinLen = 2;
+    public const int kNumAlignBits = 4;
+    public const uint kAlignTableSize = 16;
+    public const uint kAlignMask = 15;
+    public const uint kStartPosModelIndex = 4;
+    public const uint kEndPosModelIndex = 14;
+    public const uint kNumPosModels = 10;
+    public const uint kNumFullDistances = 128;
+    public const uint kNumLitPosStatesBitsEncodingMax = 4;
+    public const uint kNumLitContextBitsMax = 8;
+    public const int kNumPosStatesBitsMax = 4;
+    public const uint kNumPosStatesMax = 16;
+    public const int kNumPosStatesBitsEncodingMax = 4;
+    public const uint kNumPosStatesEncodingMax = 16;
+    public const int kNumLowLenBits = 3;
+    public const int kNumMidLenBits = 3;
+    public const int kNumHighLenBits = 8;
+    public const uint kNumLowLenSymbols = 8;
+    public const uint kNumMidLenSymbols = 8;
+    public const uint kNumLenSymbols = 272;
+    public const uint kMatchMaxLen = 273;
+
+    public static uint GetLenToPosState(uint len)
+    {
+      len -= 2U;
+      return len < 4U ? len : 3U;
+    }
+
+    public struct State
+    {
+      public uint Index;
+
+      public void Init() => this.Index = 0U;
+
+      public void UpdateChar()
+      {
+        if (this.Index < 4U)
+          this.Index = 0U;
+        else if (this.Index < 10U)
+          this.Index -= 3U;
+        else
+          this.Index -= 6U;
+      }
+
+      public void UpdateMatch() => this.Index = this.Index < 7U ? 7U : 10U;
+
+      public void UpdateRep() => this.Index = this.Index < 7U ? 8U : 11U;
+
+      public void UpdateShortRep() => this.Index = this.Index < 7U ? 9U : 11U;
+
+      public bool IsCharState() => this.Index < 7U;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZMA/Decoder.cs

@@ -0,0 +1,353 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZMA.Decoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using SevenZip.Compression.LZ;
+using SevenZip.Compression.RangeCoder;
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZMA
+{
+  public class Decoder : ICoder, ISetDecoderProperties
+  {
+    private OutWindow m_OutWindow = new OutWindow();
+    private SevenZip.Compression.RangeCoder.Decoder m_RangeDecoder = new SevenZip.Compression.RangeCoder.Decoder();
+    private BitDecoder[] m_IsMatchDecoders = new BitDecoder[new IntPtr(192)];
+    private BitDecoder[] m_IsRepDecoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRepG0Decoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRepG1Decoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRepG2Decoders = new BitDecoder[new IntPtr(12)];
+    private BitDecoder[] m_IsRep0LongDecoders = new BitDecoder[new IntPtr(192)];
+    private BitTreeDecoder[] m_PosSlotDecoder = new BitTreeDecoder[new IntPtr(4)];
+    private BitDecoder[] m_PosDecoders = new BitDecoder[new IntPtr(114)];
+    private BitTreeDecoder m_PosAlignDecoder = new BitTreeDecoder(4);
+    private Decoder.LenDecoder m_LenDecoder = new Decoder.LenDecoder();
+    private Decoder.LenDecoder m_RepLenDecoder = new Decoder.LenDecoder();
+    private Decoder.LiteralDecoder m_LiteralDecoder = new Decoder.LiteralDecoder();
+    private uint m_DictionarySize;
+    private uint m_DictionarySizeCheck;
+    private uint m_PosStateMask;
+    private bool _solid;
+
+    public Decoder()
+    {
+      this.m_DictionarySize = uint.MaxValue;
+      for (int index = 0; index < 4; ++index)
+        this.m_PosSlotDecoder[index] = new BitTreeDecoder(6);
+    }
+
+    private void SetDictionarySize(uint dictionarySize)
+    {
+      if ((int) this.m_DictionarySize == (int) dictionarySize)
+        return;
+      this.m_DictionarySize = dictionarySize;
+      this.m_DictionarySizeCheck = Math.Max(this.m_DictionarySize, 1U);
+      this.m_OutWindow.Create(Math.Max(this.m_DictionarySizeCheck, 4096U));
+    }
+
+    private void SetLiteralProperties(int lp, int lc)
+    {
+      if (lp > 8)
+        throw new InvalidParamException();
+      if (lc > 8)
+        throw new InvalidParamException();
+      this.m_LiteralDecoder.Create(lp, lc);
+    }
+
+    private void SetPosBitsProperties(int pb)
+    {
+      if (pb > 4)
+        throw new InvalidParamException();
+      uint numPosStates = (uint) (1 << pb);
+      this.m_LenDecoder.Create(numPosStates);
+      this.m_RepLenDecoder.Create(numPosStates);
+      this.m_PosStateMask = numPosStates - 1U;
+    }
+
+    private void Init(Stream inStream, Stream outStream)
+    {
+      this.m_RangeDecoder.Init(inStream);
+      this.m_OutWindow.Init(outStream, this._solid);
+      for (uint index1 = 0; index1 < 12U; ++index1)
+      {
+        for (uint index2 = 0; index2 <= this.m_PosStateMask; ++index2)
+        {
+          uint index3 = (index1 << 4) + index2;
+          this.m_IsMatchDecoders[(IntPtr) index3].Init();
+          this.m_IsRep0LongDecoders[(IntPtr) index3].Init();
+        }
+        this.m_IsRepDecoders[(IntPtr) index1].Init();
+        this.m_IsRepG0Decoders[(IntPtr) index1].Init();
+        this.m_IsRepG1Decoders[(IntPtr) index1].Init();
+        this.m_IsRepG2Decoders[(IntPtr) index1].Init();
+      }
+      this.m_LiteralDecoder.Init();
+      for (uint index = 0; index < 4U; ++index)
+        this.m_PosSlotDecoder[(IntPtr) index].Init();
+      for (uint index = 0; index < 114U; ++index)
+        this.m_PosDecoders[(IntPtr) index].Init();
+      this.m_LenDecoder.Init();
+      this.m_RepLenDecoder.Init();
+      this.m_PosAlignDecoder.Init();
+    }
+
+    public void Code(
+      Stream inStream,
+      Stream outStream,
+      long inSize,
+      long outSize,
+      ICodeProgress progress)
+    {
+      this.Init(inStream, outStream);
+      Base.State state = new Base.State();
+      state.Init();
+      uint distance = 0;
+      uint num1 = 0;
+      uint num2 = 0;
+      uint num3 = 0;
+      ulong pos = 0;
+      ulong num4 = (ulong) outSize;
+      if (pos < num4)
+      {
+        if (this.m_IsMatchDecoders[(IntPtr) (state.Index << 4)].Decode(this.m_RangeDecoder) != 0U)
+          throw new DataErrorException();
+        state.UpdateChar();
+        this.m_OutWindow.PutByte(this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, 0U, (byte) 0));
+        ++pos;
+      }
+      while (pos < num4)
+      {
+        uint posState = (uint) pos & this.m_PosStateMask;
+        if (this.m_IsMatchDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
+        {
+          byte prevByte = this.m_OutWindow.GetByte(0U);
+          this.m_OutWindow.PutByte(state.IsCharState() ? this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, (uint) pos, prevByte) : this.m_LiteralDecoder.DecodeWithMatchByte(this.m_RangeDecoder, (uint) pos, prevByte, this.m_OutWindow.GetByte(distance)));
+          state.UpdateChar();
+          ++pos;
+        }
+        else
+        {
+          uint len;
+          if (this.m_IsRepDecoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 1U)
+          {
+            if (this.m_IsRepG0Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
+            {
+              if (this.m_IsRep0LongDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
+              {
+                state.UpdateShortRep();
+                this.m_OutWindow.PutByte(this.m_OutWindow.GetByte(distance));
+                ++pos;
+                continue;
+              }
+            }
+            else
+            {
+              uint num5;
+              if (this.m_IsRepG1Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
+              {
+                num5 = num1;
+              }
+              else
+              {
+                if (this.m_IsRepG2Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
+                {
+                  num5 = num2;
+                }
+                else
+                {
+                  num5 = num3;
+                  num3 = num2;
+                }
+                num2 = num1;
+              }
+              num1 = distance;
+              distance = num5;
+            }
+            len = this.m_RepLenDecoder.Decode(this.m_RangeDecoder, posState) + 2U;
+            state.UpdateRep();
+          }
+          else
+          {
+            num3 = num2;
+            num2 = num1;
+            num1 = distance;
+            len = 2U + this.m_LenDecoder.Decode(this.m_RangeDecoder, posState);
+            state.UpdateMatch();
+            uint num6 = this.m_PosSlotDecoder[(IntPtr) Base.GetLenToPosState(len)].Decode(this.m_RangeDecoder);
+            if (num6 >= 4U)
+            {
+              int NumBitLevels = (int) (num6 >> 1) - 1;
+              uint num7 = (uint) ((2 | (int) num6 & 1) << NumBitLevels);
+              distance = num6 >= 14U ? num7 + (this.m_RangeDecoder.DecodeDirectBits(NumBitLevels - 4) << 4) + this.m_PosAlignDecoder.ReverseDecode(this.m_RangeDecoder) : num7 + BitTreeDecoder.ReverseDecode(this.m_PosDecoders, (uint) ((int) num7 - (int) num6 - 1), this.m_RangeDecoder, NumBitLevels);
+            }
+            else
+              distance = num6;
+          }
+          if ((ulong) distance >= (ulong) this.m_OutWindow.TrainSize + pos || distance >= this.m_DictionarySizeCheck)
+          {
+            if (distance != uint.MaxValue)
+              throw new DataErrorException();
+            break;
+          }
+          this.m_OutWindow.CopyBlock(distance, len);
+          pos += (ulong) len;
+        }
+      }
+      this.m_OutWindow.Flush();
+      this.m_OutWindow.ReleaseStream();
+      this.m_RangeDecoder.ReleaseStream();
+    }
+
+    public void SetDecoderProperties(byte[] properties)
+    {
+      if (properties.Length < 5)
+        throw new InvalidParamException();
+      int lc = (int) properties[0] % 9;
+      int num = (int) properties[0] / 9;
+      int lp = num % 5;
+      int pb = num / 5;
+      if (pb > 4)
+        throw new InvalidParamException();
+      uint dictionarySize = 0;
+      for (int index = 0; index < 4; ++index)
+        dictionarySize += (uint) properties[1 + index] << index * 8;
+      this.SetDictionarySize(dictionarySize);
+      this.SetLiteralProperties(lp, lc);
+      this.SetPosBitsProperties(pb);
+    }
+
+    public bool Train(Stream stream)
+    {
+      this._solid = true;
+      return this.m_OutWindow.Train(stream);
+    }
+
+    private class LenDecoder
+    {
+      private BitDecoder m_Choice = new BitDecoder();
+      private BitDecoder m_Choice2 = new BitDecoder();
+      private BitTreeDecoder[] m_LowCoder = new BitTreeDecoder[new IntPtr(16)];
+      private BitTreeDecoder[] m_MidCoder = new BitTreeDecoder[new IntPtr(16)];
+      private BitTreeDecoder m_HighCoder = new BitTreeDecoder(8);
+      private uint m_NumPosStates;
+
+      public void Create(uint numPosStates)
+      {
+        for (uint numPosStates1 = this.m_NumPosStates; numPosStates1 < numPosStates; ++numPosStates1)
+        {
+          this.m_LowCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
+          this.m_MidCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
+        }
+        this.m_NumPosStates = numPosStates;
+      }
+
+      public void Init()
+      {
+        this.m_Choice.Init();
+        for (uint index = 0; index < this.m_NumPosStates; ++index)
+        {
+          this.m_LowCoder[(IntPtr) index].Init();
+          this.m_MidCoder[(IntPtr) index].Init();
+        }
+        this.m_Choice2.Init();
+        this.m_HighCoder.Init();
+      }
+
+      public uint Decode(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint posState)
+      {
+        if (this.m_Choice.Decode(rangeDecoder) == 0U)
+          return this.m_LowCoder[(IntPtr) posState].Decode(rangeDecoder);
+        uint num = 8;
+        return this.m_Choice2.Decode(rangeDecoder) != 0U ? num + 8U + this.m_HighCoder.Decode(rangeDecoder) : num + this.m_MidCoder[(IntPtr) posState].Decode(rangeDecoder);
+      }
+    }
+
+    private class LiteralDecoder
+    {
+      private Decoder.LiteralDecoder.Decoder2[] m_Coders;
+      private int m_NumPrevBits;
+      private int m_NumPosBits;
+      private uint m_PosMask;
+
+      public void Create(int numPosBits, int numPrevBits)
+      {
+        if (this.m_Coders != null && this.m_NumPrevBits == numPrevBits && this.m_NumPosBits == numPosBits)
+          return;
+        this.m_NumPosBits = numPosBits;
+        this.m_PosMask = (uint) ((1 << numPosBits) - 1);
+        this.m_NumPrevBits = numPrevBits;
+        uint length = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
+        this.m_Coders = new Decoder.LiteralDecoder.Decoder2[(IntPtr) length];
+        for (uint index = 0; index < length; ++index)
+          this.m_Coders[(IntPtr) index].Create();
+      }
+
+      public void Init()
+      {
+        uint num = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
+        for (uint index = 0; index < num; ++index)
+          this.m_Coders[(IntPtr) index].Init();
+      }
+
+      private uint GetState(uint pos, byte prevByte) => (uint) ((((int) pos & (int) this.m_PosMask) << this.m_NumPrevBits) + ((int) prevByte >> 8 - this.m_NumPrevBits));
+
+      public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint pos, byte prevByte) => this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeNormal(rangeDecoder);
+
+      public byte DecodeWithMatchByte(
+        SevenZip.Compression.RangeCoder.Decoder rangeDecoder,
+        uint pos,
+        byte prevByte,
+        byte matchByte)
+      {
+        return this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeWithMatchByte(rangeDecoder, matchByte);
+      }
+
+      private struct Decoder2
+      {
+        private BitDecoder[] m_Decoders;
+
+        public void Create() => this.m_Decoders = new BitDecoder[768];
+
+        public void Init()
+        {
+          for (int index = 0; index < 768; ++index)
+            this.m_Decoders[index].Init();
+        }
+
+        public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder)
+        {
+          uint index = 1;
+          do
+          {
+            index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
+          }
+          while (index < 256U);
+          return (byte) index;
+        }
+
+        public byte DecodeWithMatchByte(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, byte matchByte)
+        {
+          uint index = 1;
+          do
+          {
+            uint num1 = (uint) ((int) matchByte >> 7 & 1);
+            matchByte <<= 1;
+            uint num2 = this.m_Decoders[(IntPtr) ((uint) (1 + (int) num1 << 8) + index)].Decode(rangeDecoder);
+            index = index << 1 | num2;
+            if ((int) num1 != (int) num2)
+            {
+              while (index < 256U)
+                index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
+              break;
+            }
+          }
+          while (index < 256U);
+          return (byte) index;
+        }
+      }
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/LZMA/SevenZipHelper.cs

@@ -0,0 +1,76 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.LZMA.SevenZipHelper
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+using System.IO;
+
+namespace SevenZip.Compression.LZMA
+{
+  public static class SevenZipHelper
+  {
+    private static int dictionary = 8388608;
+    private static bool eos = false;
+    private static CoderPropID[] propIDs = new CoderPropID[8]
+    {
+      CoderPropID.DictionarySize,
+      CoderPropID.PosStateBits,
+      CoderPropID.LitContextBits,
+      CoderPropID.LitPosBits,
+      CoderPropID.Algorithm,
+      CoderPropID.NumFastBytes,
+      CoderPropID.MatchFinder,
+      CoderPropID.EndMarker
+    };
+    private static object[] properties = new object[8]
+    {
+      (object) SevenZipHelper.dictionary,
+      (object) 2,
+      (object) 3,
+      (object) 0,
+      (object) 2,
+      (object) 128,
+      (object) "bt4",
+      (object) SevenZipHelper.eos
+    };
+
+    public static byte[] Compress(byte[] inputBytes)
+    {
+      MemoryStream inStream = new MemoryStream(inputBytes);
+      MemoryStream outStream = new MemoryStream();
+      Encoder encoder = new Encoder();
+      encoder.SetCoderProperties(SevenZipHelper.propIDs, SevenZipHelper.properties);
+      encoder.WriteCoderProperties((Stream) outStream);
+      long length = inStream.Length;
+      for (int index = 0; index < 8; ++index)
+        outStream.WriteByte((byte) (length >> 8 * index));
+      encoder.Code((Stream) inStream, (Stream) outStream, -1L, -1L, (ICodeProgress) null);
+      return outStream.ToArray();
+    }
+
+    public static byte[] Decompress(byte[] inputBytes)
+    {
+      MemoryStream inStream = new MemoryStream(inputBytes);
+      Decoder decoder = new Decoder();
+      inStream.Seek(0L, SeekOrigin.Begin);
+      MemoryStream outStream = new MemoryStream();
+      byte[] numArray = new byte[5];
+      if (inStream.Read(numArray, 0, 5) != 5)
+        throw new Exception("input .lzma is too short");
+      long outSize = 0;
+      for (int index = 0; index < 8; ++index)
+      {
+        int num = inStream.ReadByte();
+        if (num < 0)
+          throw new Exception("Can't Read 1");
+        outSize |= (long) (byte) num << 8 * index;
+      }
+      decoder.SetDecoderProperties(numArray);
+      long inSize = inStream.Length - inStream.Position;
+      decoder.Code((Stream) inStream, (Stream) outStream, inSize, outSize, (ICodeProgress) null);
+      return outStream.ToArray();
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/RangeCoder/BitDecoder.cs

@@ -0,0 +1,51 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitDecoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitDecoder
+  {
+    public const int kNumBitModelTotalBits = 11;
+    public const uint kBitModelTotal = 2048;
+    private const int kNumMoveBits = 5;
+    private uint Prob;
+
+    public void UpdateModel(int numMoveBits, uint symbol)
+    {
+      if (symbol == 0U)
+        this.Prob += 2048U - this.Prob >> numMoveBits;
+      else
+        this.Prob -= this.Prob >> numMoveBits;
+    }
+
+    public void Init() => this.Prob = 1024U;
+
+    public uint Decode(Decoder rangeDecoder)
+    {
+      uint num = (rangeDecoder.Range >> 11) * this.Prob;
+      if (rangeDecoder.Code < num)
+      {
+        rangeDecoder.Range = num;
+        this.Prob += 2048U - this.Prob >> 5;
+        if (rangeDecoder.Range < 16777216U)
+        {
+          rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
+          rangeDecoder.Range <<= 8;
+        }
+        return 0;
+      }
+      rangeDecoder.Range -= num;
+      rangeDecoder.Code -= num;
+      this.Prob -= this.Prob >> 5;
+      if (rangeDecoder.Range < 16777216U)
+      {
+        rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
+        rangeDecoder.Range <<= 8;
+      }
+      return 1;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/RangeCoder/BitEncoder.cs

@@ -0,0 +1,68 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitEncoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitEncoder
+  {
+    public const int kNumBitModelTotalBits = 11;
+    public const uint kBitModelTotal = 2048;
+    private const int kNumMoveBits = 5;
+    private const int kNumMoveReducingBits = 2;
+    public const int kNumBitPriceShiftBits = 6;
+    private uint Prob;
+    private static uint[] ProbPrices = new uint[new IntPtr(512)];
+
+    public void Init() => this.Prob = 1024U;
+
+    public void UpdateModel(uint symbol)
+    {
+      if (symbol == 0U)
+        this.Prob += 2048U - this.Prob >> 5;
+      else
+        this.Prob -= this.Prob >> 5;
+    }
+
+    public void Encode(Encoder encoder, uint symbol)
+    {
+      uint num = (encoder.Range >> 11) * this.Prob;
+      if (symbol == 0U)
+      {
+        encoder.Range = num;
+        this.Prob += 2048U - this.Prob >> 5;
+      }
+      else
+      {
+        encoder.Low += (ulong) num;
+        encoder.Range -= num;
+        this.Prob -= this.Prob >> 5;
+      }
+      if (encoder.Range >= 16777216U)
+        return;
+      encoder.Range <<= 8;
+      encoder.ShiftLow();
+    }
+
+    static BitEncoder()
+    {
+      for (int index1 = 8; index1 >= 0; --index1)
+      {
+        uint num1 = (uint) (1 << 9 - index1 - 1);
+        uint num2 = (uint) (1 << 9 - index1);
+        for (uint index2 = num1; index2 < num2; ++index2)
+          BitEncoder.ProbPrices[(IntPtr) index2] = (uint) (index1 << 6) + ((uint) ((int) num2 - (int) index2 << 6) >> 9 - index1 - 1);
+      }
+    }
+
+    public uint GetPrice(uint symbol) => BitEncoder.ProbPrices[(((long) (this.Prob - symbol) ^ (long) -(int) symbol) & 2047L) >> 2];
+
+    public uint GetPrice0() => BitEncoder.ProbPrices[(IntPtr) (this.Prob >> 2)];
+
+    public uint GetPrice1() => BitEncoder.ProbPrices[(IntPtr) (2048U - this.Prob >> 2)];
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/RangeCoder/BitTreeDecoder.cs

@@ -0,0 +1,66 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitTreeDecoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitTreeDecoder
+  {
+    private BitDecoder[] Models;
+    private int NumBitLevels;
+
+    public BitTreeDecoder(int numBitLevels)
+    {
+      this.NumBitLevels = numBitLevels;
+      this.Models = new BitDecoder[1 << numBitLevels];
+    }
+
+    public void Init()
+    {
+      for (uint index = 1; (long) index < (long) (1 << this.NumBitLevels); ++index)
+        this.Models[(IntPtr) index].Init();
+    }
+
+    public uint Decode(Decoder rangeDecoder)
+    {
+      uint index = 1;
+      for (int numBitLevels = this.NumBitLevels; numBitLevels > 0; --numBitLevels)
+        index = (index << 1) + this.Models[(IntPtr) index].Decode(rangeDecoder);
+      return index - (uint) (1 << this.NumBitLevels);
+    }
+
+    public uint ReverseDecode(Decoder rangeDecoder)
+    {
+      uint index1 = 1;
+      uint num1 = 0;
+      for (int index2 = 0; index2 < this.NumBitLevels; ++index2)
+      {
+        uint num2 = this.Models[(IntPtr) index1].Decode(rangeDecoder);
+        index1 = (index1 << 1) + num2;
+        num1 |= num2 << index2;
+      }
+      return num1;
+    }
+
+    public static uint ReverseDecode(
+      BitDecoder[] Models,
+      uint startIndex,
+      Decoder rangeDecoder,
+      int NumBitLevels)
+    {
+      uint num1 = 1;
+      uint num2 = 0;
+      for (int index = 0; index < NumBitLevels; ++index)
+      {
+        uint num3 = Models[(IntPtr) (startIndex + num1)].Decode(rangeDecoder);
+        num1 = (num1 << 1) + num3;
+        num2 |= num3 << index;
+      }
+      return num2;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/RangeCoder/BitTreeEncoder.cs

@@ -0,0 +1,117 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.BitTreeEncoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal struct BitTreeEncoder
+  {
+    private BitEncoder[] Models;
+    private int NumBitLevels;
+
+    public BitTreeEncoder(int numBitLevels)
+    {
+      this.NumBitLevels = numBitLevels;
+      this.Models = new BitEncoder[1 << numBitLevels];
+    }
+
+    public void Init()
+    {
+      for (uint index = 1; (long) index < (long) (1 << this.NumBitLevels); ++index)
+        this.Models[(IntPtr) index].Init();
+    }
+
+    public void Encode(Encoder rangeEncoder, uint symbol)
+    {
+      uint index = 1;
+      int numBitLevels = this.NumBitLevels;
+      while (numBitLevels > 0)
+      {
+        --numBitLevels;
+        uint symbol1 = symbol >> numBitLevels & 1U;
+        this.Models[(IntPtr) index].Encode(rangeEncoder, symbol1);
+        index = index << 1 | symbol1;
+      }
+    }
+
+    public void ReverseEncode(Encoder rangeEncoder, uint symbol)
+    {
+      uint index1 = 1;
+      for (uint index2 = 0; (long) index2 < (long) this.NumBitLevels; ++index2)
+      {
+        uint symbol1 = symbol & 1U;
+        this.Models[(IntPtr) index1].Encode(rangeEncoder, symbol1);
+        index1 = index1 << 1 | symbol1;
+        symbol >>= 1;
+      }
+    }
+
+    public uint GetPrice(uint symbol)
+    {
+      uint price = 0;
+      uint index = 1;
+      int numBitLevels = this.NumBitLevels;
+      while (numBitLevels > 0)
+      {
+        --numBitLevels;
+        uint symbol1 = symbol >> numBitLevels & 1U;
+        price += this.Models[(IntPtr) index].GetPrice(symbol1);
+        index = (index << 1) + symbol1;
+      }
+      return price;
+    }
+
+    public uint ReverseGetPrice(uint symbol)
+    {
+      uint price = 0;
+      uint index = 1;
+      for (int numBitLevels = this.NumBitLevels; numBitLevels > 0; --numBitLevels)
+      {
+        uint symbol1 = symbol & 1U;
+        symbol >>= 1;
+        price += this.Models[(IntPtr) index].GetPrice(symbol1);
+        index = index << 1 | symbol1;
+      }
+      return price;
+    }
+
+    public static uint ReverseGetPrice(
+      BitEncoder[] Models,
+      uint startIndex,
+      int NumBitLevels,
+      uint symbol)
+    {
+      uint price = 0;
+      uint num = 1;
+      for (int index = NumBitLevels; index > 0; --index)
+      {
+        uint symbol1 = symbol & 1U;
+        symbol >>= 1;
+        price += Models[(IntPtr) (startIndex + num)].GetPrice(symbol1);
+        num = num << 1 | symbol1;
+      }
+      return price;
+    }
+
+    public static void ReverseEncode(
+      BitEncoder[] Models,
+      uint startIndex,
+      Encoder rangeEncoder,
+      int NumBitLevels,
+      uint symbol)
+    {
+      uint num = 1;
+      for (int index = 0; index < NumBitLevels; ++index)
+      {
+        uint symbol1 = symbol & 1U;
+        Models[(IntPtr) (startIndex + num)].Encode(rangeEncoder, symbol1);
+        num = num << 1 | symbol1;
+        symbol >>= 1;
+      }
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/RangeCoder/Decoder.cs

@@ -0,0 +1,95 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.Decoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System.IO;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal class Decoder
+  {
+    public const uint kTopValue = 16777216;
+    public uint Range;
+    public uint Code;
+    public Stream Stream;
+
+    public void Init(Stream stream)
+    {
+      this.Stream = stream;
+      this.Code = 0U;
+      this.Range = uint.MaxValue;
+      for (int index = 0; index < 5; ++index)
+        this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
+    }
+
+    public void ReleaseStream() => this.Stream = (Stream) null;
+
+    public void CloseStream() => this.Stream.Close();
+
+    public void Normalize()
+    {
+      for (; this.Range < 16777216U; this.Range <<= 8)
+        this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
+    }
+
+    public void Normalize2()
+    {
+      if (this.Range >= 16777216U)
+        return;
+      this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
+      this.Range <<= 8;
+    }
+
+    public uint GetThreshold(uint total) => this.Code / (this.Range /= total);
+
+    public void Decode(uint start, uint size, uint total)
+    {
+      this.Code -= start * this.Range;
+      this.Range *= size;
+      this.Normalize();
+    }
+
+    public uint DecodeDirectBits(int numTotalBits)
+    {
+      uint range = this.Range;
+      uint num1 = this.Code;
+      uint num2 = 0;
+      for (int index = numTotalBits; index > 0; --index)
+      {
+        range >>= 1;
+        uint num3 = num1 - range >> 31;
+        num1 -= range & num3 - 1U;
+        num2 = (uint) ((int) num2 << 1 | 1 - (int) num3);
+        if (range < 16777216U)
+        {
+          num1 = num1 << 8 | (uint) (byte) this.Stream.ReadByte();
+          range <<= 8;
+        }
+      }
+      this.Range = range;
+      this.Code = num1;
+      return num2;
+    }
+
+    public uint DecodeBit(uint size0, int numTotalBits)
+    {
+      uint num1 = (this.Range >> numTotalBits) * size0;
+      uint num2;
+      if (this.Code < num1)
+      {
+        num2 = 0U;
+        this.Range = num1;
+      }
+      else
+      {
+        num2 = 1U;
+        this.Code -= num1;
+        this.Range -= num1;
+      }
+      this.Normalize();
+      return num2;
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Compression/RangeCoder/Encoder.cs

@@ -0,0 +1,108 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.Compression.RangeCoder.Encoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System.IO;
+
+namespace SevenZip.Compression.RangeCoder
+{
+  internal class Encoder
+  {
+    public const uint kTopValue = 16777216;
+    private Stream Stream;
+    public ulong Low;
+    public uint Range;
+    private uint _cacheSize;
+    private byte _cache;
+    private long StartPosition;
+
+    public void SetStream(Stream stream) => this.Stream = stream;
+
+    public void ReleaseStream() => this.Stream = (Stream) null;
+
+    public void Init()
+    {
+      this.StartPosition = this.Stream.Position;
+      this.Low = 0UL;
+      this.Range = uint.MaxValue;
+      this._cacheSize = 1U;
+      this._cache = (byte) 0;
+    }
+
+    public void FlushData()
+    {
+      for (int index = 0; index < 5; ++index)
+        this.ShiftLow();
+    }
+
+    public void FlushStream() => this.Stream.Flush();
+
+    public void CloseStream() => this.Stream.Close();
+
+    public void Encode(uint start, uint size, uint total)
+    {
+      this.Low += (ulong) (start * (this.Range /= total));
+      this.Range *= size;
+      while (this.Range < 16777216U)
+      {
+        this.Range <<= 8;
+        this.ShiftLow();
+      }
+    }
+
+    public void ShiftLow()
+    {
+      if ((uint) this.Low < 4278190080U || (uint) (this.Low >> 32) == 1U)
+      {
+        byte num = this._cache;
+        do
+        {
+          this.Stream.WriteByte((byte) ((ulong) num + (this.Low >> 32)));
+          num = byte.MaxValue;
+        }
+        while (--this._cacheSize != 0U);
+        this._cache = (byte) ((uint) this.Low >> 24);
+      }
+      ++this._cacheSize;
+      this.Low = (ulong) ((uint) this.Low << 8);
+    }
+
+    public void EncodeDirectBits(uint v, int numTotalBits)
+    {
+      for (int index = numTotalBits - 1; index >= 0; --index)
+      {
+        this.Range >>= 1;
+        if (((int) (v >> index) & 1) == 1)
+          this.Low += (ulong) this.Range;
+        if (this.Range < 16777216U)
+        {
+          this.Range <<= 8;
+          this.ShiftLow();
+        }
+      }
+    }
+
+    public void EncodeBit(uint size0, int numTotalBits, uint symbol)
+    {
+      uint num = (this.Range >> numTotalBits) * size0;
+      if (symbol == 0U)
+      {
+        this.Range = num;
+      }
+      else
+      {
+        this.Low += (ulong) num;
+        this.Range -= num;
+      }
+      while (this.Range < 16777216U)
+      {
+        this.Range <<= 8;
+        this.ShiftLow();
+      }
+    }
+
+    public long GetProcessedSizeAdd() => (long) this._cacheSize + this.Stream.Position - this.StartPosition + 4L;
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/DataErrorException.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.DataErrorException
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+
+namespace SevenZip
+{
+  internal class DataErrorException : ApplicationException
+  {
+    public DataErrorException()
+      : base("Data Error")
+    {
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/ICodeProgress.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ICodeProgress
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip
+{
+  public interface ICodeProgress
+  {
+    void SetProgress(long inSize, long outSize);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/ICoder.cs

@@ -0,0 +1,20 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ICoder
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System.IO;
+
+namespace SevenZip
+{
+  public interface ICoder
+  {
+    void Code(
+      Stream inStream,
+      Stream outStream,
+      long inSize,
+      long outSize,
+      ICodeProgress progress);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/ISetCoderProperties.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ISetCoderProperties
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip
+{
+  public interface ISetCoderProperties
+  {
+    void SetCoderProperties(CoderPropID[] propIDs, object[] properties);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/ISetDecoderProperties.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.ISetDecoderProperties
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+namespace SevenZip
+{
+  public interface ISetDecoderProperties
+  {
+    void SetDecoderProperties(byte[] properties);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/IWriteCoderProperties.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.IWriteCoderProperties
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System.IO;
+
+namespace SevenZip
+{
+  public interface IWriteCoderProperties
+  {
+    void WriteCoderProperties(Stream outStream);
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/InvalidParamException.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: SevenZip.InvalidParamException
+// Assembly: crypted, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 316F25AB-9DC5-41B1-B1CB-0BB9D97AEA6A
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe
+
+using System;
+
+namespace SevenZip
+{
+  internal class InvalidParamException : ApplicationException
+  {
+    public InvalidParamException()
+      : base("Invalid Parameter")
+    {
+    }
+  }
+}

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Trojan-Ransom.Win32.Gimemo.ayt.csproj

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{35D69503-6FBD-41EA-A4A3-7F88FCE6D441}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>crypted</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>SevenZip</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="DataErrorException.cs" />
+    <Compile Include="InvalidParamException.cs" />
+    <Compile Include="ICodeProgress.cs" />
+    <Compile Include="ICoder.cs" />
+    <Compile Include="CoderPropID.cs" />
+    <Compile Include="ISetCoderProperties.cs" />
+    <Compile Include="IWriteCoderProperties.cs" />
+    <Compile Include="ISetDecoderProperties.cs" />
+    <Compile Include="CRC.cs" />
+    <Compile Include="Buffer\InBuffer.cs" />
+    <Compile Include="Buffer\OutBuffer.cs" />
+    <Compile Include="Compression\LZ\IInWindowStream.cs" />
+    <Compile Include="Compression\LZ\IMatchFinder.cs" />
+    <Compile Include="Compression\LZ\InWindow.cs" />
+    <Compile Include="Compression\LZ\BinTree.cs" />
+    <Compile Include="Compression\LZ\OutWindow.cs" />
+    <Compile Include="Compression\LZMA\Base.cs" />
+    <Compile Include="Compression\LZMA\Decoder.cs" />
+    <Compile Include="Compression\LZMA\Encoder.cs" />
+    <Compile Include="Compression\LZMA\SevenZipHelper.cs" />
+    <Compile Include="Compression\RangeCoder\Encoder.cs" />
+    <Compile Include="Compression\RangeCoder\Decoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitEncoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitDecoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitTreeEncoder.cs" />
+    <Compile Include="Compression\RangeCoder\BitTreeDecoder.cs" />
+    <Compile Include="SysDriver\Driver.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="temp.resource" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan-Ransom/Win32/G/Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da/Trojan-Ransom.Win32.Gimemo.ayt.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "crypted", "Trojan-Ransom.Win32.Gimemo.ayt-7cb020d260d835f80919399a58563918f73757689e39ba851e89cc00a05535da.csproj", "{35D69503-6FBD-41EA-A4A3-7F88FCE6D441}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{35D69503-6FBD-41EA-A4A3-7F88FCE6D441}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{35D69503-6FBD-41EA-A4A3-7F88FCE6D441}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{35D69503-6FBD-41EA-A4A3-7F88FCE6D441}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{35D69503-6FBD-41EA-A4A3-7F88FCE6D441}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal