
In the screenshot, there is a call to ReadFile, but its parameters are not properly populated. I tracked down the cause and it seems that the analysis created the var_40_1 of type int128_t, which essentially treats the several pushes of the function parameters are an assignment to a stack variable. If I just the type of var_40_1 to a int32_t it will be fixed
archive.zip
passwd: infected
caution malware