decompiled agent_release

This commit is contained in:
Benjamin Palko 2026-10-14 16:45:19 -04:00
parent baac905ef2
commit 11a3488883
6439 changed files with 229565 additions and 1 deletions

View file

@ -0,0 +1,226 @@
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
* Ghidra 12.1.2 decompiler output for 0x14000a080 FUN_14000a080
* Pseudocode, not original source. */
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
void FUN_14000a080(undefined8 param_1,undefined8 param_2,ulonglong param_3,uint *param_4)
{
longlong lVar1;
wchar_t wVar2;
wchar_t *pwVar3;
wchar_t *pwVar4;
BOOL BVar5;
DWORD DVar6;
HANDLE hProcess;
char *pcVar7;
wchar_t *pwVar8;
ulonglong uVar9;
wchar_t *pwVar10;
wchar_t *pwVar11;
wchar_t *pwVar12;
undefined8 *puVar13;
short ******ppppppsVar14;
wchar_t *pwVar15;
undefined1 auStack_1c8 [32];
wchar_t *local_1a8;
wchar_t *local_1a0;
wchar_t *local_198;
wchar_t *local_190;
wchar_t *local_188;
wchar_t *local_180;
undefined8 local_170;
short *****local_168 [3];
ulonglong local_150;
undefined4 local_138 [10];
undefined2 local_110;
undefined6 uStack_10e;
undefined8 local_100;
ulonglong local_f8;
undefined2 local_e8;
undefined6 uStack_e6;
undefined8 local_d8;
ulonglong local_d0;
undefined2 local_c0;
undefined6 uStack_be;
undefined8 local_b0;
ulonglong local_a8;
undefined8 local_98;
ulonglong uStack_90;
ulonglong local_88;
ulonglong local_80;
ulonglong local_78;
ulonglong local_70;
ulonglong local_68;
void *local_60;
undefined8 local_58;
undefined8 local_50;
ulonglong local_38;
local_170 = 0xfffffffffffffffe;
local_38 = DAT_1401555a0 ^ (ulonglong)auStack_1c8;
*(undefined1 *)(DAT_140162d68 + 0x171) = 0;
printf("Auto Revive Off !!!\n");
pwVar10 = (wchar_t *)0x0;
DVar6 = 0;
local_190 = (wchar_t *)0x0;
local_188 = (wchar_t *)0x0;
local_180 = (wchar_t *)0x0;
pwVar8 = pwVar10;
pwVar11 = pwVar10;
pwVar15 = pwVar10;
if (*(longlong *)(DAT_140162d60 + 0x58) == 0) {
local_1a8 = (wchar_t *)0x0;
}
else {
local_1a8 = *(wchar_t **)(DAT_140162d60 + 0x68);
if (local_1a8 != (wchar_t *)0x0) {
local_1a0 = *(wchar_t **)local_1a8;
pwVar12 = local_1a8;
pwVar4 = local_1a0;
goto joined_r0x00014000a134;
}
}
local_1a0 = (wchar_t *)0x0;
pwVar12 = local_1a8;
pwVar4 = local_1a0;
joined_r0x00014000a134:
while (pwVar4 != (wchar_t *)0x0) {
pwVar3 = *(wchar_t **)(pwVar4 + 8);
if (pwVar3 != (wchar_t *)0x0) {
if ((pwVar3 < pwVar11) && (pwVar15 <= pwVar3)) {
lVar1 = ((longlong)pwVar3 - (longlong)pwVar15) +
SUB168(SEXT816(-0x7bdef7bdef7bdef7) * SEXT816((longlong)pwVar3 - (longlong)pwVar15),
8);
if (pwVar11 == pwVar8) {
FUN_14002d140((longlong *)&local_190);
pwVar11 = local_188;
pwVar15 = local_190;
}
local_1a8 = pwVar11;
local_198 = pwVar11;
if (pwVar11 != (wchar_t *)0x0) {
FUN_140004950((undefined4 *)pwVar11,
(undefined4 *)(pwVar15 + ((lVar1 >> 7) - (lVar1 >> 0x3f)) * 0x7c));
}
}
else {
if (pwVar11 == pwVar8) {
FUN_14002d140((longlong *)&local_190);
pwVar11 = local_188;
pwVar15 = local_190;
}
local_1a8 = pwVar11;
local_198 = pwVar11;
if (pwVar11 != (wchar_t *)0x0) {
FUN_140004950((undefined4 *)pwVar11,(undefined4 *)pwVar3);
}
}
pwVar11 = pwVar11 + 0x7c;
pwVar8 = local_180;
local_188 = pwVar11;
}
pwVar4 = *(wchar_t **)pwVar4;
while (pwVar4 == (wchar_t *)0x0) {
pwVar12 = pwVar12 + 4;
pwVar4 = *(wchar_t **)pwVar12;
}
if (pwVar12 == pwVar4) {
pwVar4 = pwVar10;
}
}
if (pwVar15 != pwVar11) {
pwVar8 = pwVar15 + 0x5c;
do {
FUN_140004ea0(local_138,(undefined4 *)(pwVar8 + -0x5c));
local_98 = *(ulonglong *)(pwVar8 + -0xc);
uStack_90 = *(ulonglong *)(pwVar8 + -8);
local_88 = *(ulonglong *)(pwVar8 + -4);
local_80 = *(ulonglong *)pwVar8;
local_78 = *(ulonglong *)(pwVar8 + 4);
local_70 = *(ulonglong *)(pwVar8 + 8);
local_68 = *(ulonglong *)(pwVar8 + 0xc);
FUN_140004d60(&local_60,(longlong *)(pwVar8 + 0x10));
param_3 = (ulonglong)local_98._4_4_;
hProcess = OpenProcess(0x1f0fff,0,local_98._4_4_);
if (hProcess != (HANDLE)0x0) {
BVar5 = GetExitCodeProcess(hProcess,(LPDWORD)&local_198);
if ((BVar5 != 0) && ((int)local_198 == 0x103)) {
TerminateProcess(hProcess,0);
}
CloseHandle(hProcess);
}
if (local_60 != (void *)0x0) {
operator_delete(local_60);
}
local_60 = (void *)0x0;
local_58 = 0;
local_50 = 0;
if (7 < local_a8) {
operator_delete((void *)CONCAT62(uStack_be,local_c0));
}
local_a8 = 7;
local_b0 = 0;
local_c0 = 0;
if (7 < local_d0) {
operator_delete((void *)CONCAT62(uStack_e6,local_e8));
}
local_d0 = 7;
local_d8 = 0;
local_e8 = 0;
if (7 < local_f8) {
operator_delete((void *)CONCAT62(uStack_10e,local_110));
}
local_f8 = 7;
local_100 = 0;
local_110 = 0;
pwVar4 = pwVar8 + 0x20;
pwVar8 = pwVar8 + 0x7c;
} while (pwVar4 != pwVar11);
}
FUN_140026820(DAT_140162d68);
for (pcVar7 = *(char **)(DAT_140162d58 + 8); pcVar7 != *(char **)(DAT_140162d58 + 0x10);
pcVar7 = pcVar7 + 0x30) {
if (*pcVar7 == '\x18') {
pwVar10 = (wchar_t *)(pcVar7 + 8);
if (7 < *(ulonglong *)(pcVar7 + 0x20)) {
pwVar10 = *(wchar_t **)pwVar10;
}
break;
}
}
uVar9 = 0xffffffffffffffff;
pwVar8 = pwVar10;
do {
if (uVar9 == 0) break;
uVar9 = uVar9 - 1;
wVar2 = *pwVar8;
pwVar8 = pwVar8 + 1;
} while (wVar2 != L'\0');
if (~uVar9 < 0x104) {
DVar6 = FUN_1400094e0(pwVar10,pwVar10,param_3,param_4);
}
uVar9 = *(ulonglong *)(DAT_1401626f8 + 0xa8);
if ((uVar9 != 0) && ((int)DVar6 < 1)) {
puVar13 = (undefined8 *)(DAT_140162d68 + 0x30);
if (7 < *(ulonglong *)(DAT_140162d68 + 0x48)) {
puVar13 = (undefined8 *)*puVar13;
}
FUN_1400dc9d0((ulonglong *)local_168,L"SUCCEED PATCH ON %s",puVar13,param_4);
ppppppsVar14 = local_168;
if (7 < local_150) {
ppppppsVar14 = (short ******)local_168[0];
}
FUN_1400080a0(uVar9,2,(short *)ppppppsVar14,param_4);
if (7 < local_150) {
operator_delete(local_168[0]);
}
}
if (pwVar15 != (wchar_t *)0x0) {
FUN_140004b30((ulonglong *)pwVar15,(ulonglong *)pwVar11);
operator_delete(pwVar15);
}
return;
}