Incorrect MLIL->HLIL lifting for obfuscated code

[xusheng6]

For the following code, the last instruction should be something like:

0040121c          int32_t eax_4 = counter
0040121c          counter = eax_4 + 1

which basically increments the counter variable by 1. However, the HLIL is wrong:

The input file is an obfuscated with junk code, and I have highlighted the relevant instructions:

BNDB: keygenme4.exe.bndb.zip

I verified the lifting is correct till MLIL, but it becomes wrong in HLIL.

[xusheng6]

My guess is the MLIL 50 and 51 are already occupied by the orphaned HLIL instruction 0x4011ac (see the first screenshot for the awkward instruction that only has counter in it), so they are no longer used by later instruciotns

[negasora]

We're somehow losing track that a variable is being used. From the end of step 1 of hlil debug report: is turning into Note the eax_428#2 on the last line didn't get replaced with counter