Suspicious
Suspect

74a980406f8b15986960ca7de5bd45a1

PE Executable
MD5: 74a980406f8b15986960ca7de5bd45a1
Size: 12.87 MB
application/x-dosexec

This sample is a 12.3 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 29 embedded or derived files. It matches 7 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
96082e1bb5350495ce83fe6ad1c26cfde4c31171c0f200bc68585d2d08f3d9ef
MD5
74a980406f8b15986960ca7de5bd45a1
Verdict
Inconclusive
File type
PE Executable · 12.3 MB

Cite this report: https://app.malva.re/sha256/96082e1bb5350495ce83fe6ad1c26cfde4c31171c0f200bc68585d2d08f3d9ef

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.87 MB · 12,873,216 B
First seen
2026-10-24 02:30 · 6 days ago
Last seen
2026-10-24 02:30 · 6 days ago
Last analysis
2026-10-24 02:30 · 6 days ago
Hashes
MD5 74a980406f8b15986960ca7de5bd45a1 Sha1 707f283d5fed6838027dc8c3b30535d77f7f83d0 Sha256 96082e1bb5350495ce83fe6ad1c26cfde4c31171c0f200bc68585d2d08f3d9ef Sha384 3a9b00ef3ed86ae40bab5d328f405c466a5d4ebcaa766c73ff2e0732b98d00cbe61b98ec87bfde250f4304359f86fbdb Sha512 78cec71f809124503a2e53fa25f4ccdd054b7e677197b1c43e0ae1b40e3bb75d0036db260d3d1b0d3d2b67247f470442485f71fdeba4f5368545280f7031e941 SSDeep 393216:nz8yoCt3G3PafufiSrRoHCX2Eo1jgxFnfKX:zHoCt3G3y8iCRmjkxFnfk TLSH EED63378ABBD0C83D2F763B06A6692834A3021478E01CA48775D165C1FADF0FD976B5B
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

30 files
EXE74a980406f8b15986960ca7de5bd45a1
Structure
BINResources
BINRT_ICON
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
IMGGemsLauncher.background.png
IMGGemsLauncher.background.png-preview.png
IMGGemsLauncher.body.png
IMGGemsLauncher.body.png-preview.png
JSONGemsLauncher.content.demo.json
JSONGemsLauncher.content.json
IMGGemsLauncher.fire.png
IMGGemsLauncher.fire.png-preview.png
IMGGemsLauncher.hand.png
IMGGemsLauncher.hand.png-preview.png
IMGGemsLauncher.head.png
IMGGemsLauncher.head.png-preview.png
IMGGemsLauncher.logo.png
IMGGemsLauncher.logo.png-preview.png
JSONGemsLauncher.calendar.json
IMGGemsLauncher.hero-unified.png
IMGGemsLauncher.hero-unified.png-preview.png
IMGGemsLauncher.eye-unified-1.png
IMGGemsLauncher.eye-unified-1.png-preview.png
IMGGemsLauncher.eye-unified-2.png
IMGGemsLauncher.eye-unified-2.png-preview.png
IMG0x0000F710.svg
IMG0x0000F710.svg-preview.jpg
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
GemsCloudLauncher.exe
Full Name
GemsCloudLauncher.exe
EntryPoint
System.Void Launcher::Main(System.String[])
Scope Name
GemsCloudLauncher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GemsCloudLauncher
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1795
Main Method
System.Void Launcher::Main(System.String[])
Main IL Instruction Count
307
Main IL 
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_0038: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0038: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Void UpdateCore::SelfTest(System.String)
leave.s IL_0066: ret
stloc.0 <null>
call System.IO.TextWriter System.Console::get_Error()
ldloc.0 <null>
callvirt System.String System.Object::ToString()
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldc.i4.2 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0066: ret
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_0067: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-crash
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0067: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Void UpdateCore::CrashTest(System.String)
ldc.i4.3 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0066: ret
pop <null>
ldc.i4.4 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0066: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_0091: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-parent
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0091: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
call System.Void UpdateCore::LaunchRecovery(System.String,System.Boolean)
leave.s IL_0090: ret
pop <null>
ldc.i4.5 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0090: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.3 <null>
bne.un IL_01B4: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --recover
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00BB: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-recover
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_01B4: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-recover
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.1 <null>
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String UpdateCore::ResolveHome(System.String)
stloc.2 <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
ldloca.s V_3
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue.s IL_00E9: ldloc.3
ldstr Processo de origem invalido.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_4
ldloc.s V_4
ldc.i4 30000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
brtrue.s IL_010A: leave.s IL_0118
ldstr O launcher anterior nao fechou.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave.s IL_0118: leave.s IL_011D
ldloc.s V_4
brfalse.s IL_0117: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_011D: ldloc.2
pop <null>
leave.s IL_011D: ldloc.2
ldloc.2 <null>
call System.Int32 UpdateCore::Recover(System.String)
stloc.s V_5
ldloc.1 <null>
brfalse.s IL_014E: ldstr "Atualizacao interrompida restaurada. O launcher sera reaberto."
ldloc.2 <null>
ldstr recovery-selftest.json
call System.String System.IO.Path::Combine(System.String,System.String)
ldsfld System.Web.Script.Serialization.JavaScriptSerializer UpdateCore::Json
ldloc.s V_5
newobj System.Void <>f__AnonymousType3`1<System.Int32>::.ctor(System.Int32)
callvirt System.String System.Web.Script.Serialization.JavaScriptSerializer::Serialize(System.Object)
call System.Void UpdateCore::DurableWrite(System.String,System.String)
leave IL_0066: ret
ldstr Atualizacao interrompida restaurada. O launcher sera reaberto.
ldstr Gems Cloud
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldloc.2 <null>
ldstr GemsCloudLauncher.exe
call System.String System.IO.Path::Combine(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01B3: ret
stloc.s V_7
ldc.i4.6 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
ldloc.1 <null>
brtrue.s IL_01B1: leave.s IL_01B3
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
ldstr  Feche o jogo e outros launchers antes de tentar novamente.
call System.String System.String::Concat(System.String,System.String)
ldstr Gems Cloud - recuperacao
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_01B3: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.3 <null>
bne.un IL_0301: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --apply
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0301: ldarg.0
ldnull <null>
stloc.s V_8
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_9
ldloc.s V_9
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Collections.Generic.Dictionary`2<System.String,System.Object> UpdateCore::Obj(System.Byte[])
stloc.s V_10
ldloc.s V_10
ldstr home
call System.String UpdateCore::Text(System.Collections.Generic.Dictionary`2<System.String,System.Object>,System.String)
stloc.s V_8
ldloc.s V_9
call System.String System.IO.Path::GetDirectoryName(System.String)
ldloc.s V_10
ldstr stage
call System.String UpdateCore::Text(System.Collections.Generic.Dictionary`2<System.String,System.Object>,System.String)
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brfalse.s IL_0226: ldstr "Plano invalido."
ldloc.s V_9
call System.String System.IO.Path::GetFileName(System.String)
ldstr apply-plan.json
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0231: ldarg.0
ldstr Plano invalido.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
ldloca.s V_11
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue.s IL_0248: ldloc.s V_11
ldstr Processo de origem invalido.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
ldloc.s V_11
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_12
ldloc.s V_12
ldc.i4 30000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
brtrue.s IL_026A: leave.s IL_0278
ldstr O launcher anterior nao fechou.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave.s IL_0278: leave.s IL_027D
ldloc.s V_12
brfalse.s IL_0277: endfinally
ldloc.s V_12
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_027D: ldloc.s V_10
pop <null>
leave.s IL_027D: ldloc.s V_10
ldloc.s V_10
ldc.i4.m1 <null>
call System.String UpdateCore::Apply(System.Collections.Generic.Dictionary`2<System.String,System.Object>,System.Int32)
pop <null>
ldstr Atualizacao concluida. O launcher sera reaberto.
ldstr Gems Cloud
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_02AE: ldloc.s V_8
stloc.s V_13
ldloc.s V_13
callvirt System.String System.Exception::get_Message()
ldstr Gems Cloud - atualizacao
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_02AE: ldloc.s V_8
ldloc.s V_8
brfalse.s IL_0300: ret
ldloc.s V_8
ldstr GemsCloudLauncher.exe
call System.String System.IO.Path::Combine(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_14
ldloc.s V_14
ldloc.s V_8
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_14
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_14
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0300: ret
stloc.s V_15
ldstr Abra o launcher novamente. 
ldloc.s V_15
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr Gems Cloud
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_0300: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ble.s IL_031E: call System.Void Launcher::EnableDpi()
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --render-preview
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_031E: call System.Void Launcher::EnableDpi()
ldarg.0 <null>
call System.Int32 Launcher::RenderPreview(System.String[])
pop <null>
ret <null>
call System.Void Launcher::EnableDpi()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Launcher::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
GemsCloudLauncher.exe
Full Name
GemsCloudLauncher.exe
EntryPoint
System.Void Launcher::Main(System.String[])
Scope Name
GemsCloudLauncher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GemsCloudLauncher
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1795
Main Method
System.Void Launcher::Main(System.String[])
Main IL Instruction Count
307
Main IL 
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_0038: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0038: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Void UpdateCore::SelfTest(System.String)
leave.s IL_0066: ret
stloc.0 <null>
call System.IO.TextWriter System.Console::get_Error()
ldloc.0 <null>
callvirt System.String System.Object::ToString()
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldc.i4.2 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0066: ret
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_0067: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-crash
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0067: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Void UpdateCore::CrashTest(System.String)
ldc.i4.3 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0066: ret
pop <null>
ldc.i4.4 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0066: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_0091: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-parent
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0091: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
call System.Void UpdateCore::LaunchRecovery(System.String,System.Boolean)
leave.s IL_0090: ret
pop <null>
ldc.i4.5 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
leave.s IL_0090: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.3 <null>
bne.un IL_01B4: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --recover
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00BB: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-recover
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_01B4: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --selftest-recover
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.1 <null>
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String UpdateCore::ResolveHome(System.String)
stloc.2 <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
ldloca.s V_3
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue.s IL_00E9: ldloc.3
ldstr Processo de origem invalido.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_4
ldloc.s V_4
ldc.i4 30000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
brtrue.s IL_010A: leave.s IL_0118
ldstr O launcher anterior nao fechou.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave.s IL_0118: leave.s IL_011D
ldloc.s V_4
brfalse.s IL_0117: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_011D: ldloc.2
pop <null>
leave.s IL_011D: ldloc.2
ldloc.2 <null>
call System.Int32 UpdateCore::Recover(System.String)
stloc.s V_5
ldloc.1 <null>
brfalse.s IL_014E: ldstr "Atualizacao interrompida restaurada. O launcher sera reaberto."
ldloc.2 <null>
ldstr recovery-selftest.json
call System.String System.IO.Path::Combine(System.String,System.String)
ldsfld System.Web.Script.Serialization.JavaScriptSerializer UpdateCore::Json
ldloc.s V_5
newobj System.Void <>f__AnonymousType3`1<System.Int32>::.ctor(System.Int32)
callvirt System.String System.Web.Script.Serialization.JavaScriptSerializer::Serialize(System.Object)
call System.Void UpdateCore::DurableWrite(System.String,System.String)
leave IL_0066: ret
ldstr Atualizacao interrompida restaurada. O launcher sera reaberto.
ldstr Gems Cloud
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldloc.2 <null>
ldstr GemsCloudLauncher.exe
call System.String System.IO.Path::Combine(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01B3: ret
stloc.s V_7
ldc.i4.6 <null>
call System.Void System.Environment::set_ExitCode(System.Int32)
ldloc.1 <null>
brtrue.s IL_01B1: leave.s IL_01B3
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
ldstr  Feche o jogo e outros launchers antes de tentar novamente.
call System.String System.String::Concat(System.String,System.String)
ldstr Gems Cloud - recuperacao
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_01B3: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.3 <null>
bne.un IL_0301: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --apply
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0301: ldarg.0
ldnull <null>
stloc.s V_8
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_9
ldloc.s V_9
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Collections.Generic.Dictionary`2<System.String,System.Object> UpdateCore::Obj(System.Byte[])
stloc.s V_10
ldloc.s V_10
ldstr home
call System.String UpdateCore::Text(System.Collections.Generic.Dictionary`2<System.String,System.Object>,System.String)
stloc.s V_8
ldloc.s V_9
call System.String System.IO.Path::GetDirectoryName(System.String)
ldloc.s V_10
ldstr stage
call System.String UpdateCore::Text(System.Collections.Generic.Dictionary`2<System.String,System.Object>,System.String)
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brfalse.s IL_0226: ldstr "Plano invalido."
ldloc.s V_9
call System.String System.IO.Path::GetFileName(System.String)
ldstr apply-plan.json
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0231: ldarg.0
ldstr Plano invalido.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
ldloca.s V_11
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brtrue.s IL_0248: ldloc.s V_11
ldstr Processo de origem invalido.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
ldloc.s V_11
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_12
ldloc.s V_12
ldc.i4 30000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
brtrue.s IL_026A: leave.s IL_0278
ldstr O launcher anterior nao fechou.
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave.s IL_0278: leave.s IL_027D
ldloc.s V_12
brfalse.s IL_0277: endfinally
ldloc.s V_12
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_027D: ldloc.s V_10
pop <null>
leave.s IL_027D: ldloc.s V_10
ldloc.s V_10
ldc.i4.m1 <null>
call System.String UpdateCore::Apply(System.Collections.Generic.Dictionary`2<System.String,System.Object>,System.Int32)
pop <null>
ldstr Atualizacao concluida. O launcher sera reaberto.
ldstr Gems Cloud
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_02AE: ldloc.s V_8
stloc.s V_13
ldloc.s V_13
callvirt System.String System.Exception::get_Message()
ldstr Gems Cloud - atualizacao
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_02AE: ldloc.s V_8
ldloc.s V_8
brfalse.s IL_0300: ret
ldloc.s V_8
ldstr GemsCloudLauncher.exe
call System.String System.IO.Path::Combine(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_14
ldloc.s V_14
ldloc.s V_8
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_14
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_14
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0300: ret
stloc.s V_15
ldstr Abra o launcher novamente. 
ldloc.s V_15
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr Gems Cloud
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_0300: ret
ret <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ble.s IL_031E: call System.Void Launcher::EnableDpi()
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --render-preview
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_031E: call System.Void Launcher::EnableDpi()
ldarg.0 <null>
call System.Int32 Launcher::RenderPreview(System.String[])
pop <null>
ret <null>
call System.Void Launcher::EnableDpi()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Launcher::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

30 files
EXE74a980406f8b15986960ca7de5bd45a1
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙