You read the compiled artifact. It's not complicated. Source code gives you valuable added context about programmer intent, which is helpful to understand how a program is structured, but you can't trust that intent if you're looking for surreptitious code anyways, and you don't need to to work out what the program is doing.