Hello and welcome in this lecture, I'm going to analyze the wishing tree obfuscated function in peace
to you, so I drank the wishing tree to be still you.
If you head over to the imports group now and screw all the way down to Dynamic Link Library.
You can still see that get progress here and get more new handle.
He still visible, however, these to not include it by our program.
It is loaded by the loader operating system for Windows, so it is quite safe.
Now you can confirm that by opening Hasti Big 64bit.
Make sure your option preferences, high schools and then open our tree.
And then we will put a break point.
Go to Planetary two and look for progress
and put points on both of these.
Check to make sure check to make sure that your for any set and then right now he's on Cape Progress.
But if you take a look at the X in the second parameter for get from, if it's not being called or used
in by our movie, it is used by the operating system loader, which many loads you will use to get progress.
So this is nothing suspicious.
It'll run again.
It from addresses hit again the same empty.
No, it is capable address dress is using address as a lock.
Again, it is not something that is used by our military, our members using which you are a lock and
you will never you will never find what you are being used by a proper address.
Because if you quiz Katie, using our own customize can progress building right now is ever have a set
value.
Same now is initialized critical sections.
And again, at least a look at as good value.
Set value, not strings
for ABC, right?
Sunken handle, Santa Close handle.
And debugging stuff, because the program actually did.
So you see that progress was never used to call to look forward to a lock.
So even though it shows up in here, but there is no connection whatsoever with our program, we'll
know there.
So there's a distinct appearing here is quite say it is not our program.
She looks the gate progress or get them on your hanger.
So that's all I wanted to point out to explain.
Why is this issue showing here, even though we have already managed to create our own customized,
capable and modular API functions?
So that's all for this video.
Thank you for watching.