Imports System
Imports System.IO
Imports System.Reflection
Imports System.Runtime.InteropServices
Imports System.Security.Cryptography
Friend Class class44
' Methods
Public Shared Sub smethod_0()
Dim buffer As Byte()
Dim num6 As UInt64
Dim buffer5 As Byte()
Dim buffer7 As Byte()
Dim modules = GetType(Class44).Module
Dim hINSTANCE As IntPtr = Marshal.GetHINSTANCE([module])
If (hINSTANCE = DirectCast(-1, IntPtr)) Then
Environment.FailFast("Module error")
End If
Dim flag As Boolean = ([Module].FullyQualifiedName <> "<Unknown>")
Dim input As Stream = New UnmanagedMemoryStream(DirectCast(hINSTANCE.ToPointer, Byte()), &HFFFFFFF, &HFFFFFFF, FileAccess.ReadWrite)
Using reader As BinaryReader = New BinaryReader(input)
input.Seek(60, SeekOrigin.Begin)
Dim num20 As UInt32 = reader.ReadUInt32
input.Seek(CLng(num20), SeekOrigin.Begin)
input.Seek(6, SeekOrigin.Current)
Dim num16 As UInt32 = reader.ReadUInt16
input.Seek(12, SeekOrigin.Current)
Dim num12 As UInt32 = reader.ReadUInt16
input.Seek(CLng(num20 = (num20 + &H18)), SeekOrigin.Begin)
reader.ReadUInt16()
input.Seek(CLng((&H12AA0A85 - (&H84605F3 + (&H32D30358 - &H286EFF04)))), SeekOrigin.Current)
Dim position As Long = input.Position
Dim num24 As UInt32 = (reader.ReadUInt32 Xor &HF35ACEAB)
If (num24 = 4082814635) Then
Environment.FailFast("Broken file")
End If
input.Seek(CLng(num20 = (num20 + num12)), SeekOrigin.Begin)
Dim num19 As UInt32 = 0
Dim i As Integer
For i = 0 To num16 - 1
Dim num8 As Integer = 0
Dim j As Integer
For j = 0 To 8 - 1
Dim num7 As Byte = reader.ReadByte
If (num7 <> 0) Then
num8 = (num8 + num7)
End If
Next j
Dim num9 As UInt32 = reader.ReadUInt32
Dim num25 As UInt32 = reader.ReadUInt32
reader.ReadUInt32()
Dim num22 As UInt32 = reader.ReadUInt32
If (num8 = &H2EB) Then
num19 = If(flag, num25, num22)
End If
If ((Not flag AndAlso (num24 > num25)) AndAlso (num24 < (num25 + num9))) Then
num24 = ((num24 - num25) + num22)
End If
input.Seek(&H10, SeekOrigin.Current)
Next i
input.Seek(CLng(num24), SeekOrigin.Begin)
Using stream As MemoryStream = New MemoryStream
input.Position = (input.Position + 12)
input.Position = (input.Position + (reader.ReadUInt32 + 4))
input.Position = (input.Position + 2)
Dim num4 As UInt16 = reader.ReadUInt16
Dim k As Integer
For k = 0 To num4 - 1
Dim num3 As UInt32 = (reader.ReadUInt32 + num24)
Dim num23 As UInt32 = reader.ReadUInt32
Dim num2 As Integer = 0
Do While (reader.ReadByte <> 0)
num2 += 1
Loop
Dim num15 As Long = input.Position = (input.Position + ((((num2 + 1) + 3) And -4) - (num2 + 1)))
input.Position = num3
stream.Write(reader.ReadBytes(CInt(num23)), 0, CInt(num23))
input.Position = num15
Next k
buffer = stream.ToArray
End Using
input.Seek(CLng(num19), SeekOrigin.Begin)
num6 = (reader.ReadUInt64 Xor &HE5612E2DF445B800)
reader.ReadInt32()
reader.ReadInt32()
buffer5 = reader.ReadBytes((reader.ReadInt32 Xor -2142010449))
buffer7 = reader.ReadBytes((reader.ReadInt32 Xor (-1563764463 - 584282670)))
End Using
Dim buffer6 As Byte() = MD5.Create.ComputeHash(buffer)
Dim num21 As UInt64 = (BitConverter.ToUInt64(buffer6, 0) Xor BitConverter.ToUInt64(buffer6, 8))
If (num21 <> num6) Then
Environment.FailFast("Broken file")
End If
Dim src As Byte() = Class44.smethod_1(buffer, buffer5, buffer7)
Buffer.BlockCopy(New Byte(buffer.Length - 1) {}, 0, buffer, 0, buffer.Length)
If ((src(0) <> &HD6) OrElse (src(1) <> (-1310245325 + &H4E18C23C))) Then
Environment.FailFast("Broken file")
End If
Dim dst As Byte() = New Byte((src.Length - 2) - 1) {}
Buffer.BlockCopy(src, 2, dst, 0, dst.Length)
Using reader2 As BinaryReader = New BinaryReader(New MemoryStream(dst))
Dim num5 As UInt32 = reader2.ReadUInt32
Dim numArray As Integer() = New Integer(num5 - 1) {}
Dim ptrArray As IntPtr() = New IntPtr(num5 - 1) {}
Dim m As Integer
For m = 0 To num5 - 1
Dim num11 As UInt32 = (reader2.ReadUInt32 Xor Convert.ToUInt32((&H45C825D3 + &H2374C49)))
If (num11 <> 0) Then
Dim num10 As UInt32
Dim num17 As UInt32 = (reader2.ReadUInt32 Xor &HF68733B4)
Dim source As Byte() = reader2.ReadBytes(reader2.ReadInt32)
Dim lpAddress As IntPtr = CType(CULng((CInt(hINSTANCE) + If(flag, num17, num11))), IntPtr)
Class44.VirtualProtect(lpAddress, DirectCast(source.Length, UInt32), 4, num10)
Marshal.Copy(source, 0, lpAddress, source.Length)
Class44.VirtualProtect(lpAddress, DirectCast(source.Length, UInt32), num10, num10)
numArray(m) = source.Length
ptrArray(m) = lpAddress
End If
Next m
End Using
End Sub
Private Shared Function smethod_1(ByVal buff As Byte(), ByVal iv As Byte(), ByVal dat As Byte()) As Byte()
Dim managed As New RijndaelManaged
Dim buffer As Byte() = New Byte(dat.Length - 1) {}
Dim stream As New MemoryStream(dat)
Using stream2 As CryptoStream = New CryptoStream(stream, managed.CreateDecryptor(SHA256.Create.ComputeHash(buff), iv), CryptoStreamMode.Read)
stream2.Read(buffer, 0, dat.Length)
End Using
Dim sha As SHA512 = SHA512.Create
Dim buffer2 As Byte() = sha.ComputeHash(buff)
Dim i As Integer = 0
Do While (i < buffer.Length)
Dim num3 As Integer = If((buffer.Length <= (i + &H40)), buffer.Length, (i + (&HB22EA35 - &HB22E9F5)))
Dim j As Integer
For j = i To num3 - 1
buffer(j) = CByte((buffer(j) Xor CByte((buffer2((j - i)) Xor (-989194682 + (&H2AD0BE21 + &H10252BB8))))))
Next j
buffer2 = sha.ComputeHash(buffer, i, (num3 - i))
i = (i + ((&H657E86C Xor &H2445494C) Xor (-1210807988 + (&H4DEA76BD Xor &H27D46EA9))))
Loop
Return buffer
End Function
<DllImport("kernel32.dll")> _
Private Shared Function VirtualProtect(ByVal lpAddress As IntPtr, ByVal dwSize As UInt32, ByVal flNewProtect As UInt32, <Out()> ByRef lpflOldProtect As UInt32) As Boolean
End Function
End Class
