I am currently investigating a protected .NET malware.

I am working on a PE file that is using the same kind of protection. It decrypts its IL code during runtime. I know a piece of the true IL code.

I was able to recover a piece of the same IL code at two different moment. picture of the 3 versions of the IL code

The first line is the first version of the IL code in memory.

The second line, just before the compileMethod

The last line is what I am supposed to get eventually.

I would like to understand how the evasion works. Why is possible to compile the IL with 0x0A800005 instead of 0x0A00001D (Systems.Windows.Form.Label) and still having a running program.

Is there a way to resolve 0x0A800005 during runtime and understand it is somehow associated with Systems.Windows.Form.Label ?

Thank you in advance