From 923fb1f9ca8468f8841a97b103ec404e007ca5f9 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Sun, 5 Aug 2012 04:42:59 +0200
Subject: [PATCH] Call the correct ctor

---
 de4dot.code/deobfuscators/Confuser/Deobfuscator.cs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs
index 6a628543..53c1e57f 100644
--- a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs
@@ -205,7 +205,9 @@ namespace de4dot.code.deobfuscators.Confuser {
 			CanUnpack = 2,
 		}
 		DecryptState decryptState = DecryptState.CanDecryptMethods | DecryptState.CanUnpack;
+		bool hasUnpacked = false;
 		public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
+			hasUnpacked = false;
 			byte[] fileData = getFileData();
 			var peImage = new PeImage(fileData);
 
@@ -242,6 +244,7 @@ namespace de4dot.code.deobfuscators.Confuser {
 						realAssemblyInfo = mainInfo.realAssemblyInfo;
 						embeddedAssemblyInfos.AddRange(unpacker.getEmbeddedAssemblyInfos());
 						ModuleBytes = newFileData;
+						hasUnpacked = true;
 						return true;
 					}
 					else {
@@ -276,7 +279,8 @@ namespace de4dot.code.deobfuscators.Confuser {
 			newOne.ModuleBytes = ModuleBytes;
 			newOne.embeddedAssemblyInfos.AddRange(embeddedAssemblyInfos);
 			newOne.setModule(module);
-			newOne.jitMethodsDecrypter = new JitMethodsDecrypter(module, DeobfuscatedFile, jitMethodsDecrypter);
+			newOne.jitMethodsDecrypter = hasUnpacked ? new JitMethodsDecrypter(module, DeobfuscatedFile) :
+						new JitMethodsDecrypter(module, DeobfuscatedFile, jitMethodsDecrypter);
 			if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
 				try {
 					newOne.jitMethodsDecrypter.find();
@@ -286,7 +290,8 @@ namespace de4dot.code.deobfuscators.Confuser {
 				if (newOne.jitMethodsDecrypter.Detected)
 					return newOne;
 			}
-			newOne.memoryMethodsDecrypter = new MemoryMethodsDecrypter(module, DeobfuscatedFile, memoryMethodsDecrypter);
+			newOne.memoryMethodsDecrypter = hasUnpacked ? new MemoryMethodsDecrypter(module, DeobfuscatedFile) :
+						new MemoryMethodsDecrypter(module, DeobfuscatedFile, memoryMethodsDecrypter);
 			if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
 				newOne.memoryMethodsDecrypter.find();
 				if (newOne.memoryMethodsDecrypter.Detected)