Skip to content

Imports symbols are not resolved #375

@wargio

Description

@wargio
sub.msvcrt.dll__XcptFilter();
0x1400018ee      jmp     qword [_XcptFilter] ; 0x140002240
void sub.msvcrt.dll__XcptFilter(void)
{
    // WARNING: Treating indirect jump as call
    (*(code *)0x2ab6)();
    return;
}

another one, notice the arg1_00 = (*(code *)0x2bec)(0);

uint64_t fcn.140001958(int64_t arg1)
{
    uintmax_t arg1_00;
    int64_t iVar1;
    
    arg1_00 = (*(code *)0x2bec)(0);
    if ((arg1_00 != 0) && (iVar1 = fcn.1400018fc(arg1_00), iVar1 != 0)) {
        if (*(int16_t *)(iVar1 + 0x5c) == 2) {
            return 2;
        }
        if (*(int16_t *)(iVar1 + 0x5c) == 3) {
            return 1;
        }
    }
    return arg1 & 0xffffffff;
}
fcn.140001958(int64_t arg1);
; arg int64_t arg1 @ rcx
0x140001958      push    rbx
0x14000195a      sub     rsp, 0x20
0x14000195e      mov     ebx, ecx  ; arg1
0x140001960      xor     ecx, ecx  ; LPCWSTR lpModuleName
0x140001962      call    qword [GetModuleHandleW] ; 0x1400021c0 ; HMODULE GetModuleHandleW(LPCWSTR lpModuleName)
0x140001968      test    rax, rax
0x14000196b      jz      0x140001995
0x14000196d      mov     rcx, rax  ; uintmax_t arg1
0x140001970      call    fcn.1400018fc ; fcn.1400018fc
0x140001975      test    rax, rax
0x140001978      jz      0x140001995
0x14000197a      mov     ecx, 0x02
0x14000197f      cmp     word [rax+0x5c], cx
0x140001983      jnz     0x140001989
0x140001985      mov     eax, ecx
0x140001987      jmp     0x140001997
0x140001989      cmp     word [rax+0x5c], 0x03
0x14000198e      mov     eax, 0x01
0x140001993      jz      0x140001997
0x140001995      mov     eax, ebx
0x140001997      add     rsp, 0x20
0x14000199b      pop     rbx
0x14000199c      ret

calc.tar.gz

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions