Analysis creates stack variable of type int128_t for pushes instead of treating them as parameters to a function call

[xusheng6]

In the screenshot, there is a call to ReadFile, but its parameters are not properly populated. I tracked down the cause and it seems that the analysis created the var_40_1 of type int128_t, which essentially treats the several pushes of the function parameters are an assignment to a stack variable. If I just the type of var_40_1 to a int32_t it will be fixed

archive.zip

passwd: infected

caution malware