/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469 * Ghidra 12.1.2 decompiler output for 0x14000a080 FUN_14000a080 * Pseudocode, not original source. */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void FUN_14000a080(undefined8 param_1,undefined8 param_2,ulonglong param_3,uint *param_4) { longlong lVar1; wchar_t wVar2; wchar_t *pwVar3; wchar_t *pwVar4; BOOL BVar5; DWORD DVar6; HANDLE hProcess; char *pcVar7; wchar_t *pwVar8; ulonglong uVar9; wchar_t *pwVar10; wchar_t *pwVar11; wchar_t *pwVar12; undefined8 *puVar13; short ******ppppppsVar14; wchar_t *pwVar15; undefined1 auStack_1c8 [32]; wchar_t *local_1a8; wchar_t *local_1a0; wchar_t *local_198; wchar_t *local_190; wchar_t *local_188; wchar_t *local_180; undefined8 local_170; short *****local_168 [3]; ulonglong local_150; undefined4 local_138 [10]; undefined2 local_110; undefined6 uStack_10e; undefined8 local_100; ulonglong local_f8; undefined2 local_e8; undefined6 uStack_e6; undefined8 local_d8; ulonglong local_d0; undefined2 local_c0; undefined6 uStack_be; undefined8 local_b0; ulonglong local_a8; undefined8 local_98; ulonglong uStack_90; ulonglong local_88; ulonglong local_80; ulonglong local_78; ulonglong local_70; ulonglong local_68; void *local_60; undefined8 local_58; undefined8 local_50; ulonglong local_38; local_170 = 0xfffffffffffffffe; local_38 = DAT_1401555a0 ^ (ulonglong)auStack_1c8; *(undefined1 *)(DAT_140162d68 + 0x171) = 0; printf("Auto Revive Off !!!\n"); pwVar10 = (wchar_t *)0x0; DVar6 = 0; local_190 = (wchar_t *)0x0; local_188 = (wchar_t *)0x0; local_180 = (wchar_t *)0x0; pwVar8 = pwVar10; pwVar11 = pwVar10; pwVar15 = pwVar10; if (*(longlong *)(DAT_140162d60 + 0x58) == 0) { local_1a8 = (wchar_t *)0x0; } else { local_1a8 = *(wchar_t **)(DAT_140162d60 + 0x68); if (local_1a8 != (wchar_t *)0x0) { local_1a0 = *(wchar_t **)local_1a8; pwVar12 = local_1a8; pwVar4 = local_1a0; goto joined_r0x00014000a134; } } local_1a0 = (wchar_t *)0x0; pwVar12 = local_1a8; pwVar4 = local_1a0; joined_r0x00014000a134: while (pwVar4 != (wchar_t *)0x0) { pwVar3 = *(wchar_t **)(pwVar4 + 8); if (pwVar3 != (wchar_t *)0x0) { if ((pwVar3 < pwVar11) && (pwVar15 <= pwVar3)) { lVar1 = ((longlong)pwVar3 - (longlong)pwVar15) + SUB168(SEXT816(-0x7bdef7bdef7bdef7) * SEXT816((longlong)pwVar3 - (longlong)pwVar15), 8); if (pwVar11 == pwVar8) { FUN_14002d140((longlong *)&local_190); pwVar11 = local_188; pwVar15 = local_190; } local_1a8 = pwVar11; local_198 = pwVar11; if (pwVar11 != (wchar_t *)0x0) { FUN_140004950((undefined4 *)pwVar11, (undefined4 *)(pwVar15 + ((lVar1 >> 7) - (lVar1 >> 0x3f)) * 0x7c)); } } else { if (pwVar11 == pwVar8) { FUN_14002d140((longlong *)&local_190); pwVar11 = local_188; pwVar15 = local_190; } local_1a8 = pwVar11; local_198 = pwVar11; if (pwVar11 != (wchar_t *)0x0) { FUN_140004950((undefined4 *)pwVar11,(undefined4 *)pwVar3); } } pwVar11 = pwVar11 + 0x7c; pwVar8 = local_180; local_188 = pwVar11; } pwVar4 = *(wchar_t **)pwVar4; while (pwVar4 == (wchar_t *)0x0) { pwVar12 = pwVar12 + 4; pwVar4 = *(wchar_t **)pwVar12; } if (pwVar12 == pwVar4) { pwVar4 = pwVar10; } } if (pwVar15 != pwVar11) { pwVar8 = pwVar15 + 0x5c; do { FUN_140004ea0(local_138,(undefined4 *)(pwVar8 + -0x5c)); local_98 = *(ulonglong *)(pwVar8 + -0xc); uStack_90 = *(ulonglong *)(pwVar8 + -8); local_88 = *(ulonglong *)(pwVar8 + -4); local_80 = *(ulonglong *)pwVar8; local_78 = *(ulonglong *)(pwVar8 + 4); local_70 = *(ulonglong *)(pwVar8 + 8); local_68 = *(ulonglong *)(pwVar8 + 0xc); FUN_140004d60(&local_60,(longlong *)(pwVar8 + 0x10)); param_3 = (ulonglong)local_98._4_4_; hProcess = OpenProcess(0x1f0fff,0,local_98._4_4_); if (hProcess != (HANDLE)0x0) { BVar5 = GetExitCodeProcess(hProcess,(LPDWORD)&local_198); if ((BVar5 != 0) && ((int)local_198 == 0x103)) { TerminateProcess(hProcess,0); } CloseHandle(hProcess); } if (local_60 != (void *)0x0) { operator_delete(local_60); } local_60 = (void *)0x0; local_58 = 0; local_50 = 0; if (7 < local_a8) { operator_delete((void *)CONCAT62(uStack_be,local_c0)); } local_a8 = 7; local_b0 = 0; local_c0 = 0; if (7 < local_d0) { operator_delete((void *)CONCAT62(uStack_e6,local_e8)); } local_d0 = 7; local_d8 = 0; local_e8 = 0; if (7 < local_f8) { operator_delete((void *)CONCAT62(uStack_10e,local_110)); } local_f8 = 7; local_100 = 0; local_110 = 0; pwVar4 = pwVar8 + 0x20; pwVar8 = pwVar8 + 0x7c; } while (pwVar4 != pwVar11); } FUN_140026820(DAT_140162d68); for (pcVar7 = *(char **)(DAT_140162d58 + 8); pcVar7 != *(char **)(DAT_140162d58 + 0x10); pcVar7 = pcVar7 + 0x30) { if (*pcVar7 == '\x18') { pwVar10 = (wchar_t *)(pcVar7 + 8); if (7 < *(ulonglong *)(pcVar7 + 0x20)) { pwVar10 = *(wchar_t **)pwVar10; } break; } } uVar9 = 0xffffffffffffffff; pwVar8 = pwVar10; do { if (uVar9 == 0) break; uVar9 = uVar9 - 1; wVar2 = *pwVar8; pwVar8 = pwVar8 + 1; } while (wVar2 != L'\0'); if (~uVar9 < 0x104) { DVar6 = FUN_1400094e0(pwVar10,pwVar10,param_3,param_4); } uVar9 = *(ulonglong *)(DAT_1401626f8 + 0xa8); if ((uVar9 != 0) && ((int)DVar6 < 1)) { puVar13 = (undefined8 *)(DAT_140162d68 + 0x30); if (7 < *(ulonglong *)(DAT_140162d68 + 0x48)) { puVar13 = (undefined8 *)*puVar13; } FUN_1400dc9d0((ulonglong *)local_168,L"SUCCEED PATCH ON %s",puVar13,param_4); ppppppsVar14 = local_168; if (7 < local_150) { ppppppsVar14 = (short ******)local_168[0]; } FUN_1400080a0(uVar9,2,(short *)ppppppsVar14,param_4); if (7 < local_150) { operator_delete(local_168[0]); } } if (pwVar15 != (wchar_t *)0x0) { FUN_140004b30((ulonglong *)pwVar15,(ulonglong *)pwVar11); operator_delete(pwVar15); } return; }