Let's continue with your analysis so we know that this is a correct function, we can rename it.
Before we can, Niemi, we have to actually create a function because at the moment it is undefined.
So to create a function, get back to the place where this function is found, which is over here,
the start of the push EVP.
And how did I get here?
I go to the strip search, go back to the Unical for the wrong message, we're here.
And then I went back to cross-reference that with.
And I lembeck over here.
Correct, Carol, if you want to see the rest of the three dots here, you can use this and click on
the tree dots.
You will highlight the run you can draw and now you can see the rest of tree dots.
So now we have to look for the start of this functions.
This whole thing is continuing to function, so we need to scroll up and look for the Kushayb, which
marks the start on this function.
Bush, MBP.
There you go.
So once you found the Bush CVP, you can recreate a function here by clicking and select create function.
So now you have a function.
And now you can double click on this, go back to the decompiled, and now you have proper function
rather than undefined function.
So now you can rename it my recollection of pressing in on the keyboard and rename it.
And we can call this check serial killer.
He could be anything like a tree.
Right now in the licensee's function, we will start from what we know, we know for sure that this
virus is important.
It needs to be zero in order to be correct.
So I one one is probably an integer.
We can rename it as a result.
And this result is coming from dysfunction, dysfunction is doing some kind of comparison, I believe,
if I were to be able to there seems to be a Windows API.
Get local time.
So let's go to Google crew and look it up.
Get coast time,
and probably this is the one that you want.
Getting local time, let's check it out.
So getting local time will return.
Just in time to the perimeter in which it is passed and House is Alby's Eastern Time is a structure
to receive current liquidity in time or a.
So that means we can rename local authority to become.
System time.
So this is consistent time.
So let's rename it.
All right, so in some time now, we are doing some kind of operation.
Just in time you can see here.
All right, let's see, refer to the API Damon once more and see what it does in order to get a better
understanding of what system times structure, we need to enter this right.
Click open a new 10.
And here is.
The third explanation, the what is systematical about about year, the first members year, second
memories month and so on.
So what is he trying to do here?
It isn't time.
It is performing a bitwise operation so we can look it up.
I've already got the page open here.
And you can see bitwise binary right here to the left, operands value is moved to right by the number
of B specified by the right open.
So when you use this understanding with this, it means you are shifting by hex.
Then Hexton is 16 16.
So that means we are accessing probably.
Definitely not the first one probably ever shifting into their members.
So what is supposed to be
a supposedly two by two vice or 16 bids?
Sixteen bits.
So when you perform sheaf of 16 bits, that means you're assessing the second member, the second member.
So if one were 16, which if you perform a shift operation of 16, which means you're assessing the
month, the month.
So over here, you are shifting 16 bits to assess the month.
So lorcaserin see in a month, literally nearly two months.
So now you have month here and asking online and what is local to see locally to see she's 16 and you
need to find out what is like to see.
So sometimes we don't get any clue by looking at the compiler.
We can go back to the existing view to get some more hints.
And the other thing is the asprin F, I think this is asprin that because it takes this as a parameter
to perform some kind of operation.
So what is asprin that?
If you look up the Internet, search for aspirin, five aspirin, it takes at least half for specifiers
to construct a string.
So, for example, if you have this kind of fire and you were using aspirin, if
you put the target string here, followed by your former specify and head and neck, he will pull all
your other strings here.
So in the end, he will get together string, which is made up, and string A, B and C all along together
in one string.
So if you had something like this, so in in your target string would become.
That's Dash, so dash this dash, which is coming from here, and then followed by the one one.
Coming from here to two, coming from here, she's A, B and C coming from here, which is C, so this
is the meaning of form it specifies.
So this is a kind of format specify a string integer, integer, integer.
So in the end, your target string will be this.
This will be a target string so we can make some deductions by analyzing the code here.
We know that the target string is nine.
This is this one.
So this must be the target string so we can use string relabelled as a target string.
So targeting is actually my circle, the actual key, actual key string,
so we make assumptions like this and modify as we discover more more data and more fact, that means
this one must be Springstead so we can relabelled as bringeth.
So from this, we now can deduce that all the parameters above are the parameters that we push to be
used by this function.
So you have man, you have no.
When look 60, which we don't know what it is, but we know for sure months or months.
One of the parameters used by this function and if we lost like this, sometimes it's good to go back
to the existing view, the assembly.
So this is a button where you move barometer's to Espenak and this is where you call the function asprin.
So over here above will be all your parameters that are used by your espenak.
So we can see that one of the parameter is mund.
Just turn this on one of the paramilitaries Mund.
Monday then, so we have three others, this one I typically used for storing string's, probably this
would be a target string so we can just relabel this has targeted this editable and call its target
string
and then this one Veerman.
So what are the other to a lucky guess who be here man in the here man day.
So we assume that this was here.
We can call this here, we can it here
and we can edit this to be this as the just change the label the.
And it makes sense because Manti's Attracta from you can see here threat from the system time.
So it makes sense that the other two is also coming from system time.
So we can deduce that most probably only three are coming from Sistan time.
And we can go back to just in time to take a look see time last year, a year man and B, how these
three things like this.
So we can based on this and how the evidence he has seen it is a good.
Deduction that probably this is the money year and how and you can confirm the year for them by looking
at that one.
So when you look at parent one parent one receives the pointer to the address of this structure.
So the pointer to a structure is the first element on the structure usually.
And what is the first element of the structure here?
So that one is actually a pointer to the year, so we can actually rename this param one.
Point to.
Just in time, and this is a point at his own time, he also points to a year
point so we can probably point to just in time and for Saliman.
So, Saliman, of the point of this structure is yourself, right?
So this makes more sense now.
So most likely you are right.
Did you see his a year here, man in the.
And this one probably is the string, this one.
The string, so the string is probably the your name, because when we go back and take a look at the
correct me if I see a name, there must be a reason why it was a name.
It's probably going to use it to create the Cedar Key.
And then when we see this string component here making more or less guess that this must be the name
you enter.
So and he requires a barometer for that.
So there must be this.
So now that we examine anything, we can really what is based on new findings.
So this is not a string you can really be has named.
Industry, so now this makes sense.
He makes a lot of sense, he named String, goes to the house within 48, specified a year, goes to
the the year one, goes to the other for pacifier and then goes to the last one.
So this is very rarely if our hypothesis this we saw this now that the Espina coming from here has been
coming home here is really the exception, all these parameters and these are the key.
So based on this, we can more or less guess now what is our psyche?
So the first parameter will be whatever you enter.
So if that's the test, then you said that, then you insert a year.
So let's say to these two to one, then you insert a month.
Now is much, so much history.
And finally the day.
So to this date is 19.
You can go up here.
And who we are now is to confirm the date so much, two to one.
Right.
So now we're going to test this hierarchy and see.
Right.
So I'm going to enter Tarsier and then Shiraki will be test for by day two to one three and a 90 is
the.
Yes, correct.
So now you saw this.
Correct me.
So this is how you do analysis.
Sometimes the compiler is not accurate and makes mistakes.
So we have to read between the lines and then go and analyze the other things in the listing, referred
online to the episode like this, and then open up a notepad as scratchpad to make your notes and test
hypotheses.
If your hypothesis is wrong, you re redefining change and Intesa how bad it is.
Again, that's all for this video.
Thank you for watching.