/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469 * Ghidra 12.1.2 pseudocode via REA, ev_ad71d730ad826f5e73d5b5ec119273acf91c525002d977f0d017bc11eb2cfbb4 * Decompiler output, not original source. */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong FUN_140009780(wchar_t *param_1) { int iVar1; BOOL BVar2; HANDLE hObject; HANDLE hProcess; undefined4 extraout_var; undefined4 extraout_var_00; undefined1 auStack_278 [32]; undefined4 local_258 [2]; DWORD local_250; wchar_t local_22c [266]; ulonglong local_18; local_18 = DAT_1401555a0 ^ (ulonglong)auStack_278; if (param_1 != (wchar_t *)0x0) { hObject = (HANDLE)CreateToolhelp32Snapshot(2); memset(local_258,0,0x238); local_258[0] = 0x238; iVar1 = Process32FirstW(hObject,local_258); while (iVar1 != 0) { iVar1 = _wcsicmp(param_1,local_22c); if ((iVar1 == 0) && (hProcess = OpenProcess(1,0,local_250), hProcess != (HANDLE)0xffffffffffffffff)) { wprintf(L"Process Kill.!!! [%s] \n"); TerminateProcess(hProcess,0); BVar2 = CloseHandle(hProcess); return CONCAT71((int7)(CONCAT44(extraout_var_00,BVar2) >> 8),1); } iVar1 = Process32NextW(hObject,local_258); } BVar2 = CloseHandle(hObject); local_18 = CONCAT44(extraout_var,BVar2); } return local_18 & 0xffffffffffffff00; }