Decrypting intunewin files

using (FileStream fileStream = new FileStream(packageFile, FileMode.Open, FileAccess.Read, FileShare.None, bufferSize: 4096, useAsync: true))
{
    await Zipper.UnzipStreamAsync(fileStream, tempFolder, cancellationToken);
}

internal static async Task UnzipStreamAsync(Stream stream, string destinationFolder, CancellationToken cancellationToken)
{
    using (ZipArchive archive = new ZipArchive(stream, ZipArchiveMode.Read, false))
    {
        foreach (ZipArchiveEntry entry in archive.Entries)
        {
            if (cancellationToken.IsCancellationRequested)
                break;
            string directoryName = Path.Combine(destinationFolder, Path.GetDirectoryName(entry.FullName));
            if (!string.IsNullOrEmpty(directoryName))
                Directory.CreateDirectory(directoryName);
            if (entry.Length > 0L)
            {
                string destinationFileName = Path.Combine(destinationFolder, entry.FullName);
                using (Stream entryStream = entry.Open())
                using (FileStream fileStream = new FileStream(destinationFileName, FileMode.Create, FileAccess.Write, FileShare.None, bufferSize: 4096, useAsync: true))
                {
                    await entryStream.CopyToAsync(fileStream);
                    fileStream.Close();
                    entryStream.Close();
                }
            }
        }
    }
}

var metadataFile = Path.Combine(tempFolder, "IntuneWinPackage", "Metadata", "Detection.xml");
ApplicationInfo? applicationInfo = null;
using (FileStream metadataStream = new FileStream(metadataFile, FileMode.Open, FileAccess.Read, FileShare.None, bufferSize: 4096, useAsync: true))
using (StreamReader metadataReader = new StreamReader(metadataStream))
{
    applicationInfo = ApplicationInfo.FromXml(metadataReader);
    metadataReader.Close();
    metadataStream.Close();
}

if (applicationInfo == null || applicationInfo.EncryptionInfo == null)
    throw new InvalidDataException(string.Format(CultureInfo.InvariantCulture, "Could not read metadata file {0}", metadataFile));

// A StreamReader is in fact a TextReader, so we can use the XmlSerializer to deserialize the XML data.
internal static ApplicationInfo FromXml(TextReader textReader)
{
    return (ApplicationInfo)new XmlSerializer(typeof(ApplicationInfo)).Deserialize(textReader);
}

var encryptedPackage = Path.Combine(tempFolder, "IntuneWinPackage", "Contents", applicationInfo.FileName);
logger.LogDebug("Decrypting {EncryptedPackage} to {OutputFolder}", encryptedPackage, outputFolder);
using (FileStream encryptedFileStream = new FileStream(encryptedPackage, FileMode.Open, FileAccess.Read, FileShare.None, bufferSize: 4096, useAsync: true))
using (Stream decryptedStream = await Encryptor.DecryptFileAsync(encryptedFileStream, applicationInfo.EncryptionInfo.EncryptionKey!, applicationInfo.EncryptionInfo.MacKey!, cancellationToken))
{
    // Using the same unzip method as before, but now on the decrypted stream.
    await Zipper.UnzipStreamAsync(decryptedStream, outputFolder, cancellationToken);
    decryptedStream.Close();
    encryptedFileStream.Close();
    logger.LogInformation("Unpacked intunewin at {PackageFile} to {OutputFolder}", packageFile, outputFolder);
}

internal static async Task<Stream> DecryptFileAsync(Stream inputStream, string encryptionKey, string hmacKey, CancellationToken cancellationToken)
{
    var resultStream = new MemoryStream();
    // Get the encryptionKey and the hmacKey as byte arrays, since they are stored as base64 strings.
    var encryptionKeyBytes = Convert.FromBase64String(encryptionKey);
    var hmacKeyBytes = Convert.FromBase64String(hmacKey);
    using (Aes aes = Aes.Create())
    using (HMACSHA256 hmac = new HMACSHA256(hmacKeyBytes))
    {
        int offset = hmac.HashSize / 8;
        byte[] buffer = new byte[offset];
        // Read the first 32 bytes, which is the hash, this will also move the stream forward.
        await inputStream.ReadAsync(buffer, 0, offset, cancellationToken);
        // Compute the hash of the remaining bytes.
        byte[] hash = await hmac.ComputeHashAsync(inputStream, cancellationToken);
        // Compare the hashes, if they don't match, throw an exception.
        if (!buffer.CompareHashes(hash))
        {
            throw new InvalidDataException("Hashes do not match");
        }
        // Rewind the stream to the beginning of the encrypted data.
        inputStream.Seek(offset, SeekOrigin.Begin);
        byte[] iv = new byte[aes.IV.Length];
        // Read the IV from the stream, (next 16 bytes).
        await inputStream.ReadAsync(iv, 0, iv.Length, cancellationToken);
        // Create a cryptostream with a decryptor with the encryptionKey and the IV.
        using (ICryptoTransform cryptoTransform = aes.CreateDecryptor(encryptionKeyBytes, iv))
        using (CryptoStream cryptoStream = new CryptoStream(inputStream, cryptoTransform, CryptoStreamMode.Read))
        {
            // Copy the decrypted data to the resultStream.
            await cryptoStream.CopyToAsync(resultStream, 2097152, cancellationToken);
            // Rewind the resultStream to the beginning.
            resultStream.Seek(0, SeekOrigin.Begin);
        }
    }
    // Return the resultStream, which still is a Stream which has to be closed by the caller.
    return resultStream;
}