rusty-hearts/server-re
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

decompiled agent_release

Browse source
This commit is contained in:
Benjamin Palko 2026-10-14 16:45:19 -04:00
parent baac905ef2
commit 11a3488883
6439 changed files with 229565 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

44
decomp/Agent_Release_x64/0x140009780.pseudo.c Normal file
View file

@ -0,0 +1,44 @@
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
* Ghidra 12.1.2 pseudocode via REA, ev_ad71d730ad826f5e73d5b5ec119273acf91c525002d977f0d017bc11eb2cfbb4
* Decompiler output, not original source. */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
ulonglong FUN_140009780(wchar_t *param_1)
{
int iVar1;
BOOL BVar2;
HANDLE hObject;
HANDLE hProcess;
undefined4 extraout_var;
undefined4 extraout_var_00;
undefined1 auStack_278 [32];
undefined4 local_258 [2];
DWORD local_250;
wchar_t local_22c [266];
ulonglong local_18;
local_18 = DAT_1401555a0 ^ (ulonglong)auStack_278;
if (param_1 != (wchar_t *)0x0) {
hObject = (HANDLE)CreateToolhelp32Snapshot(2);
memset(local_258,0,0x238);
local_258[0] = 0x238;
iVar1 = Process32FirstW(hObject,local_258);
while (iVar1 != 0) {
iVar1 = _wcsicmp(param_1,local_22c);
if ((iVar1 == 0) &&
(hProcess = OpenProcess(1,0,local_250), hProcess != (HANDLE)0xffffffffffffffff)) {
wprintf(L"Process Kill.!!! [%s] \n");
TerminateProcess(hProcess,0);
BVar2 = CloseHandle(hProcess);
return CONCAT71((int7)(CONCAT44(extraout_var_00,BVar2) >> 8),1);
}
iVar1 = Process32NextW(hObject,local_258);
}
BVar2 = CloseHandle(hObject);
local_18 = CONCAT44(extraout_var,BVar2);
}
return local_18 & 0xffffffffffffff00;
}