/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469 * Ghidra 12.1.2 pseudocode via REA, ev_e77cf4b520f4fa0b88408c03b2bdd27ca462d9ca84b0de51180cb56c85771b34 * Decompiler output, not original source. */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ DWORD FUN_1400094e0(wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) { int *piVar1; wchar_t wVar2; BOOL BVar3; longlong *plVar4; int *piVar5; HANDLE hObject; ulonglong uVar6; wchar_t *pwVar7; LPWSTR lpCommandLine; undefined8 uVar8; DWORD DVar9; wchar_t *pwVar10; code *pcVar11; undefined8 uVar12; _PROCESS_INFORMATION *_ArgList; undefined1 auStackY_538 [32]; undefined *local_4e8; _PROCESS_INFORMATION local_4e0; int *local_4c8; undefined1 local_4c0; undefined8 local_4b8; _STARTUPINFOW local_4a8; wchar_t local_438; undefined1 local_436 [526]; wchar_t local_228; undefined1 local_226 [526]; ulonglong local_18; local_4b8 = 0xfffffffffffffffe; local_18 = DAT_1401555a0 ^ (ulonglong)auStackY_538; DVar9 = 0; local_228 = L'\0'; memset(local_226,0,0x206); local_438 = L'\0'; memset(local_436,0,0x206); uVar6 = 0xffffffffffffffff; pwVar10 = param_1; do { if (uVar6 == 0) break; uVar6 = uVar6 - 1; wVar2 = *pwVar10; pwVar10 = pwVar10 + 1; } while (wVar2 != L'\0'); uVar6 = ~uVar6; wcscpy_s(&local_228,uVar6,param_1); plVar4 = FUN_14002fe90((longlong *)&local_4e8,uVar6,param_1,param_4); pwVar10 = (wchar_t *)*plVar4; if ((wchar_t *)*plVar4 == (wchar_t *)0x0) { pwVar10 = (wchar_t *)PTR_DAT_140155010; } pwVar7 = &local_438; wcscpy_s(&local_438,0x104,pwVar10); if (((local_4e8 != (undefined *)0x0) && (local_4e8 != PTR_DAT_140155010)) && (local_4e8 + -8 != (undefined *)0x0)) { piVar5 = (int *)FUN_140030200(pwVar7,local_4e8,pwVar10,param_4); local_4c8 = piVar5; FUN_14002e6e0(piVar5); local_4c0 = 1; piVar1 = (int *)(local_4e8 + -4); *piVar1 = *piVar1 + -1; if (*piVar1 == 0) { FUN_1400302f0(local_4e8 + -8); } FUN_14002e770((longlong)piVar5); } memset(&local_4a8,0,0x68); local_4a8.cb = 0x68; local_4a8.dwFlags = 0x13; local_4a8.dwXSize = 700; local_4a8.dwYSize = 0x6e; local_4a8.dwFillAttribute = 0x17; local_4a8.wShowWindow = 5; uVar12 = 0; uVar8 = 0; lpCommandLine = &local_228; BVar3 = CreateProcessW((LPCWSTR)0x0,lpCommandLine,(LPSECURITY_ATTRIBUTES)0x0, (LPSECURITY_ATTRIBUTES)0x0,0,0x10,(LPVOID)0x0,&local_438,&local_4a8, &local_4e0); if (BVar3 == 0) { FUN_140010aa0(L"=======Server Fail=======\n",lpCommandLine,uVar8,uVar12); FUN_140010aa0(L"Path\t: [%s] \n",&local_438,uVar8,uVar12); FUN_140010aa0(L"File\t: [%s] \n",&local_228,uVar8,uVar12); } else { CloseHandle(local_4e0.hThread); _ArgList = &local_4e0; pcVar11 = FUN_140008c90; uVar8 = 0; hObject = (HANDLE)_beginthreadex((void *)0x0,0,FUN_140008c90,_ArgList,0,(uint *)&local_4e8); CloseHandle(hObject); FUN_140010aa0(L"=======ServerOn=======\n",uVar8,pcVar11,_ArgList); DVar9 = local_4e0.dwProcessId; } printf("//////////////////////////////////////////////////////////////////////////\n"); Sleep(1000); return DVar9; }