{"artifacts":[{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe"},{"architecture":"x86_64","digest":{"sha256":"7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1"},"format":"pe"}],"captures":[],"environments":[],"providers":[{"id":"ghidra","name":"Ghidra","version":"12.1.2"},{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}],"records":[{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_012fe9a8b5ae820b5e27c8dce3640c618b17b0d98f0a9e7b40cf9d54ba530ea6","evidence_links":[],"limitations":["Derived by an REA composed workflow.","An exact external entry resolves to its observed function identity even when its body is empty. This does not establish mapped executable bytes or containment of nearby external addresses.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","Synthetic Ghidra entry-point references without actionable memory sources are omitted.","The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"matches":[{"address":"0x14011b718","type":"string","value":"# Agent Startup #\n\n"}],"query":"# Agent Startup #","references":[{"containing_procedure":{"found":true,"procedure":{"address":"0x1400037a0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140003f22","start":"0x1400037a0"}],"span_bytes":1923,"total_bytes":1923},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_1400037a0"},"query_address":"0x140003802"},"source_address":"0x140003802","target_address":"0x14011b718"}],"residual_unknowns":[],"search_mode":"literal","truncated":false},"operation":"trace_feature","parameters":{"case_sensitive":true,"query":"# Agent Startup #"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_1d95f4cc432b924b60ef50234430db8c3ff42279e3b202d1afd48393d575c240","evidence_links":[],"limitations":["Derived by an REA composed workflow.","An exact external entry resolves to its observed function identity even when its body is empty. This does not establish mapped executable bytes or containment of nearby external addresses.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","Synthetic Ghidra entry-point references without actionable memory sources are omitted.","The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB MessageServer_Release_x64.pdb (GUID cde07e33-d76f-49e7-887c-43afecaef251, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"matches":[{"address":"0x14015a550","type":"string","value":"REQ_MSG_WHISPER"},{"address":"0x14015a560","type":"string","value":"REQ_MSG_WHISPER_ACK"},{"address":"0x14015c890","type":"string","value":"REQ_MSG_WHISPER_ACK"},{"address":"0x14015c8b8","type":"string","value":"REQ_MSG_WHISPER"}],"query":"REQ_MSG_WHISPER","references":[{"containing_procedure":{"found":true,"procedure":{"address":"0x1400075d0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140007761","start":"0x1400075d0"}],"span_bytes":402,"total_bytes":402},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_1400075d0"},"query_address":"0x140007606"},"source_address":"0x140007606","target_address":"0x14015a550"},{"containing_procedure":{"found":true,"procedure":{"address":"0x1400075d0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140007761","start":"0x1400075d0"}],"span_bytes":402,"total_bytes":402},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_1400075d0"},"query_address":"0x14000760d"},"source_address":"0x14000760d","target_address":"0x14015a550"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140007770","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x1400078d8","start":"0x140007770"}],"span_bytes":361,"total_bytes":361},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140007770"},"query_address":"0x14000779f"},"source_address":"0x14000779f","target_address":"0x14015a560"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140007770","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x1400078d8","start":"0x140007770"}],"span_bytes":361,"total_bytes":361},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140007770"},"query_address":"0x1400077a6"},"source_address":"0x1400077a6","target_address":"0x14015a560"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140012179"},"source_address":"0x140012179","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140012180"},"source_address":"0x140012180","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x1400123b6"},"source_address":"0x1400123b6","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140012497"},"source_address":"0x140012497","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x1400124af"},"source_address":"0x1400124af","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x1400124f6"},"source_address":"0x1400124f6","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x14001258d"},"source_address":"0x14001258d","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140012613"},"source_address":"0x140012613","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x14001262c"},"source_address":"0x14001262c","target_address":"0x14015c890"},{"containing_procedure":{"found":false,"procedure":null,"query_address":"0x1401b3288","reason":"not_in_procedure"},"source_address":"0x1401b3288","target_address":"0x14015c890"},{"containing_procedure":{"found":false,"procedure":null,"query_address":"0x1401b3318","reason":"not_in_procedure"},"source_address":"0x1401b3318","target_address":"0x14015c890"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011ab8"},"source_address":"0x140011ab8","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011abf"},"source_address":"0x140011abf","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011cce"},"source_address":"0x140011cce","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011dbb"},"source_address":"0x140011dbb","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011dd3"},"source_address":"0x140011dd3","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011e1a"},"source_address":"0x140011e1a","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011eb7"},"source_address":"0x140011eb7","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011f35"},"source_address":"0x140011f35","target_address":"0x14015c8b8"},{"containing_procedure":{"found":true,"procedure":{"address":"0x140011930","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140014092","start":"0x140011930"}],"span_bytes":10083,"total_bytes":10083},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140011930"},"query_address":"0x140011f4e"},"source_address":"0x140011f4e","target_address":"0x14015c8b8"},{"containing_procedure":{"found":false,"procedure":null,"query_address":"0x1401b3280","reason":"not_in_procedure"},"source_address":"0x1401b3280","target_address":"0x14015c8b8"},{"containing_procedure":{"found":false,"procedure":null,"query_address":"0x1401b3310","reason":"not_in_procedure"},"source_address":"0x1401b3310","target_address":"0x14015c8b8"},{"containing_procedure":{"found":false,"procedure":null,"query_address":"0x1401b3570","reason":"not_in_procedure"},"source_address":"0x1401b3570","target_address":"0x14015c8b8"},{"containing_procedure":{"found":false,"procedure":null,"query_address":"0x1401b3580","reason":"not_in_procedure"},"source_address":"0x1401b3580","target_address":"0x14015c8b8"}],"residual_unknowns":[],"search_mode":"literal","truncated":false},"operation":"trace_feature","parameters":{"case_sensitive":true,"query":"REQ_MSG_WHISPER"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/MessageServer_Release_x64.exe","name":"MessageServer_Release_x64.exe"}},{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_227d432add3641fdfa217deb151ecc801fa8b01b853b70d77af3d37ff3bc6d8d","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","Ghidra Listing reports a terminal call at 0x14000758a to 0x14006be00 FUN_14006be00 (external=false, thunk=false, hasNoReturn=true); fallthrough is excluded by Ghidra's flow model. This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.","Ghidra Listing reports a terminal call at 0x140007595 to 0x1400064e0 FUN_1400064e0 (external=false, thunk=false, hasNoReturn=true); fallthrough is excluded by Ghidra's flow model. This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.","Ghidra Listing reports a terminal call at 0x1400075bd to 0x14006b3e0 FUN_14006b3e0 (external=false, thunk=false, hasNoReturn=false); fallthrough is excluded by Ghidra's flow model. The reason for the terminal flow is not established by this observation.","The target references PDB MessageServer_Release_x64.pdb (GUID cde07e33-d76f-49e7-887c-43afecaef251, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":"\nvoid FUN_140007480(longlong param_1,longlong param_2,undefined8 param_3,longlong param_4)\n\n{\n undefined4 uVar1;\n int iVar2;\n longlong lVar3;\n longlong lVar4;\n longlong lVar5;\n int iVar6;\n longlong lVar7;\n undefined4 *puVar8;\n undefined4 *puVar9;\n \n FUN_14006b350((int *)(param_1 + 0x110));\n if (*(longlong *)(param_1 + 0xd0) == 0) {\n puVar8 = (undefined4 *)0x0;\n }\n else {\n puVar8 = *(undefined4 **)(param_1 + 0xc0);\n }\n while( true ) {\n if (puVar8 == (undefined4 *)0x0) {\n FUN_14006b3e0(param_1 + 0x110);\n return;\n }\n if (puVar8 == (undefined4 *)0x0) break;\n puVar9 = (undefined4 *)0x0;\n if (puVar8 != (undefined4 *)0x0) {\n puVar9 = *(undefined4 **)(puVar8 + 4);\n }\n uVar1 = *puVar8;\n iVar2 = *(int *)(param_2 + 0x18);\n if (iVar2 < 0) {\n /* WARNING: Subroutine does not return */\n FUN_14006be00();\n }\n iVar6 = *(int *)(param_2 + 0x18);\n FUN_140063f80(param_2,iVar6 + 1,param_3,param_4);\n iVar6 = iVar6 - iVar2;\n if ((0 < iVar6) && (iVar6 = iVar6 + -1, lVar7 = (longlong)iVar6, -1 < iVar6)) {\n lVar5 = (lVar7 + iVar2) * 4 + 4;\n do {\n lVar3 = FUN_140008250(param_2);\n lVar4 = FUN_140008250(param_2);\n *(undefined4 *)(lVar4 + lVar5) = *(undefined4 *)(lVar3 + -4 + lVar5);\n lVar5 = lVar5 + -4;\n lVar7 = lVar7 + -1;\n } while (-1 < lVar7);\n }\n lVar7 = FUN_140008250(param_2);\n *(undefined4 *)(lVar7 + (longlong)iVar2 * 4) = uVar1;\n puVar8 = puVar9;\n }\n /* WARNING: Subroutine does not return */\n FUN_1400064e0(0x80004005);\n}\n\n","operation":"procedure_pseudo_code","parameters":{"procedure":"0x140007480"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":{"limitations":["Ghidra Listing reports a terminal call at 0x14000758a to 0x14006be00 FUN_14006be00 (external=false, thunk=false, hasNoReturn=true); fallthrough is excluded by Ghidra's flow model. This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.","Ghidra Listing reports a terminal call at 0x140007595 to 0x1400064e0 FUN_1400064e0 (external=false, thunk=false, hasNoReturn=true); fallthrough is excluded by Ghidra's flow model. This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.","Ghidra Listing reports a terminal call at 0x1400075bd to 0x14006b3e0 FUN_14006b3e0 (external=false, thunk=false, hasNoReturn=false); fallthrough is excluded by Ghidra's flow model. The reason for the terminal flow is not established by this observation."],"value":"\nvoid FUN_140007480(longlong param_1,longlong param_2,undefined8 param_3,longlong param_4)\n\n{\n undefined4 uVar1;\n int iVar2;\n longlong lVar3;\n longlong lVar4;\n longlong lVar5;\n int iVar6;\n longlong lVar7;\n undefined4 *puVar8;\n undefined4 *puVar9;\n \n FUN_14006b350((int *)(param_1 + 0x110));\n if (*(longlong *)(param_1 + 0xd0) == 0) {\n puVar8 = (undefined4 *)0x0;\n }\n else {\n puVar8 = *(undefined4 **)(param_1 + 0xc0);\n }\n while( true ) {\n if (puVar8 == (undefined4 *)0x0) {\n FUN_14006b3e0(param_1 + 0x110);\n return;\n }\n if (puVar8 == (undefined4 *)0x0) break;\n puVar9 = (undefined4 *)0x0;\n if (puVar8 != (undefined4 *)0x0) {\n puVar9 = *(undefined4 **)(puVar8 + 4);\n }\n uVar1 = *puVar8;\n iVar2 = *(int *)(param_2 + 0x18);\n if (iVar2 < 0) {\n /* WARNING: Subroutine does not return */\n FUN_14006be00();\n }\n iVar6 = *(int *)(param_2 + 0x18);\n FUN_140063f80(param_2,iVar6 + 1,param_3,param_4);\n iVar6 = iVar6 - iVar2;\n if ((0 < iVar6) && (iVar6 = iVar6 + -1, lVar7 = (longlong)iVar6, -1 < iVar6)) {\n lVar5 = (lVar7 + iVar2) * 4 + 4;\n do {\n lVar3 = FUN_140008250(param_2);\n lVar4 = FUN_140008250(param_2);\n *(undefined4 *)(lVar4 + lVar5) = *(undefined4 *)(lVar3 + -4 + lVar5);\n lVar5 = lVar5 + -4;\n lVar7 = lVar7 + -1;\n } while (-1 < lVar7);\n }\n lVar7 = FUN_140008250(param_2);\n *(undefined4 *)(lVar7 + (longlong)iVar2 * 4) = uVar1;\n puVar8 = puVar9;\n }\n /* WARNING: Subroutine does not return */\n FUN_1400064e0(0x80004005);\n}\n\n"},"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/MessageServer_Release_x64.exe","name":"MessageServer_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_25c4e9fcabb403ee8698522246bb6efb24b8b97619b1eea7b8f9024abd2f8839","evidence_links":[],"limitations":["Derived by an REA composed workflow.","An exact external entry resolves to its observed function identity even when its body is empty. This does not establish mapped executable bytes or containment of nearby external addresses.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","Synthetic Ghidra entry-point references without actionable memory sources are omitted.","The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"matches":[{"address":"0x14011d130","type":"string","value":"Process Kill.!!! [%s] \n"}],"query":"Process Kill","references":[{"containing_procedure":{"found":true,"procedure":{"address":"0x140009780","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140009889","start":"0x140009780"}],"span_bytes":266,"total_bytes":266},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140009780"},"query_address":"0x140009862"},"source_address":"0x140009862","target_address":"0x14011d130"}],"residual_unknowns":[],"search_mode":"literal","truncated":false},"operation":"trace_feature","parameters":{"case_sensitive":true,"query":"Process Kill"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_2fa3bc1da1e9e82a4bd2859ca38ee1636f1ade7ba45372348ff4288d16c2f449","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */\n\nundefined8 FUN_1400037a0(longlong param_1,undefined8 **param_2,undefined8 *param_3,uint *param_4)\n\n{\n int *piVar1;\n double dVar2;\n char cVar3;\n undefined8 *puVar4;\n undefined1 auVar5 [16];\n bool bVar6;\n bool bVar7;\n longlong *plVar8;\n BOOL BVar9;\n wchar_t *pwVar10;\n wchar_t *pwVar11;\n ulonglong uVar12;\n longlong *plVar13;\n wchar_t *pwVar14;\n char *pcVar15;\n ulonglong *puVar16;\n longlong *plVar17;\n undefined2 *puVar18;\n wchar_t *pwVar19;\n longlong lVar20;\n undefined4 uVar21;\n undefined4 uVar22;\n undefined4 uVar23;\n undefined4 uVar24;\n undefined4 uVar25;\n undefined1 auStack_2a8 [32];\n longlong *local_288;\n wchar_t *local_280;\n LARGE_INTEGER local_278;\n undefined8 *local_270;\n wchar_t *local_268;\n wchar_t *local_260;\n int *local_258;\n undefined1 local_250;\n undefined8 local_248;\n undefined2 local_238;\n undefined1 local_236 [158];\n undefined1 local_198 [160];\n undefined8 *local_f8;\n undefined2 local_f0;\n undefined6 uStack_ee;\n undefined8 local_e0;\n ulonglong local_d8;\n undefined2 local_c8;\n undefined6 uStack_c6;\n undefined8 local_b8;\n ulonglong local_b0;\n ulonglong local_98;\n \n local_248 = 0xfffffffffffffffe;\n local_98 = DAT_1401555a0 ^ (ulonglong)auStack_2a8;\n FUN_140010960(L\"# Agent Startup #\\n\\n\",param_2,param_3,param_4);\n CoInitialize((LPVOID)0x0);\n FUN_140010aa0(L\"+ Prepare Startup\\n\",param_2,param_3,param_4);\n local_278 = (LARGE_INTEGER)operator_new(0xb8);\n pwVar19 = (wchar_t *)0x0;\n pwVar10 = pwVar19;\n if ((undefined8 *)local_278.QuadPart != (undefined8 *)0x0) {\n pwVar10 = (wchar_t *)FUN_140005020((undefined8 *)local_278,param_2,param_3,param_4);\n }\n if (pwVar10 == (wchar_t *)0x0) {\n local_288 = (longlong *)0x0;\n }\n else {\n local_288 = (longlong *)FUN_140030280(0x10);\n local_288[1] = 1;\n *local_288 = (longlong)pwVar10;\n }\n plVar17 = local_288;\n pwVar11 = operator_new(0x68);\n pwVar10 = pwVar19;\n local_280 = pwVar11;\n if (pwVar11 != (wchar_t *)0x0) {\n if (plVar17 != (longlong *)0x0) {\n pwVar10 = (wchar_t *)*plVar17;\n }\n *(wchar_t **)pwVar11 = pwVar10;\n pwVar11[4] = L'\\0';\n pwVar11[5] = L'\\0';\n pwVar11[6] = L'\\0';\n pwVar11[7] = L'\\0';\n pwVar11[8] = L'\\0';\n pwVar11[9] = L'\\0';\n pwVar11[10] = L'\\0';\n pwVar11[0xb] = L'\\0';\n pwVar11[0xc] = L'\\0';\n pwVar11[0xd] = L'\\0';\n pwVar11[0xe] = L'\\0';\n pwVar11[0xf] = L'\\0';\n uVar12 = FUN_14002e790();\n param_2 = (undefined8 **)(uVar12 & 0xffffffff);\n param_3 = (undefined8 *)CONCAT71((int7)((ulonglong)param_3 >> 8),1);\n FUN_14002e600((undefined4 *)(pwVar11 + 0x14),(ulonglong)param_2,param_3,param_4);\n FUN_140007960((longlong)pwVar11);\n pwVar10 = pwVar11;\n }\n if (pwVar10 == (wchar_t *)0x0) {\n local_280 = (wchar_t *)0x0;\n }\n else {\n local_280 = (wchar_t *)FUN_140030280(0x10);\n *(undefined8 *)((longlong)local_280 + 8) = 1;\n *(wchar_t **)local_280 = pwVar10;\n }\n pwVar10 = local_280;\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n *(wchar_t **)(param_1 + 0xa0) = pwVar11;\n pwVar11 = pwVar19;\n if (local_280 != (wchar_t *)0x0) {\n pwVar11 = *(wchar_t **)local_280;\n }\n *(wchar_t **)(param_1 + 0xa8) = pwVar11;\n pwVar11 = pwVar19;\n if (local_280 != (wchar_t *)0x0) {\n pwVar11 = *(wchar_t **)local_280;\n }\n FUN_140007960((longlong)pwVar11);\n local_f8 = (undefined8 *)0x0;\n local_d8 = 7;\n local_e0 = 0;\n local_f0 = 0;\n local_b0 = 7;\n local_b8 = 0;\n local_c8 = 0;\n if (*(longlong *)(DAT_140162d68 + 0x1c8) != 0) {\n auVar5._8_8_ = 0;\n auVar5._0_8_ = *(ulonglong *)(DAT_140162d68 + 0x1b0);\n param_2 = SUB168((ZEXT816(0) << 0x40 | ZEXT816(0x15)) % auVar5,0);\n local_270 = (undefined8 *)(*(longlong *)(DAT_140162d68 + 0x1a8) + (longlong)param_2 * 8);\n for (local_268 = (wchar_t *)*local_270; local_268 != (wchar_t *)0x0;\n local_268 = *(wchar_t **)local_268) {\n if ((char)local_268[4] == '\\x15') {\n if (local_268 != (wchar_t *)0x0) goto LAB_1400039c4;\n break;\n }\n }\n }\n local_270 = (undefined8 *)0x0;\n local_268 = pwVar19;\nLAB_1400039c4:\n if ((local_268 != (wchar_t *)0x0) &&\n (puVar4 = *(undefined8 **)(local_268 + 8), puVar4 != *(undefined8 **)(local_268 + 0xc))) {\n local_f8 = (undefined8 *)*puVar4;\n FUN_140001600((longlong *)&local_f0,puVar4 + 1,0,0xffffffffffffffff);\n param_4 = (uint *)0xffffffffffffffff;\n param_3 = (undefined8 *)0x0;\n FUN_140001600((longlong *)&local_c8,puVar4 + 6,0,0xffffffffffffffff);\n param_2 = &local_f8;\n FUN_140007a80(*(undefined8 **)(param_1 + 0xa8),param_2,param_3,(undefined8 *)param_4);\n lVar20 = *(longlong *)(param_1 + 0xa8);\n piVar1 = (int *)(lVar20 + 0x28);\n local_258 = piVar1;\n FUN_14002e6e0(piVar1);\n plVar13 = *(longlong **)(lVar20 + 8);\n if (*plVar13 == 0) {\n FUN_14002e770((longlong)piVar1);\n local_250 = 0;\n }\n else {\n lVar20 = *plVar13;\n FUN_14002e770((longlong)piVar1);\n local_250 = 0;\n if (lVar20 != 0) {\n cVar3 = *(char *)(lVar20 + 0x88);\n while (cVar3 == '\\0') {\n FUN_1400023e0(lVar20);\n cVar3 = *(char *)(lVar20 + 0x88);\n }\n }\n }\n }\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n FUN_140005360((longlong)pwVar11,param_2,param_3,(longlong)param_4);\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n *(undefined8 *)(pwVar11 + 0x24) = *(undefined8 *)(param_1 + 0xa8);\n FUN_140010960(L\"\\n # Agent Running... #\\n\",param_2,param_3,param_4);\n plVar13 = operator_new(0x18);\n if (plVar13 == (longlong *)0x0) {\n plVar13 = (longlong *)0x0;\n }\n else {\n *plVar13 = (longlong)TimeSourceHRWin32::vftable;\n BVar9 = QueryPerformanceFrequency(&local_278);\n if (BVar9 == 0) {\n *(undefined1 *)(plVar13 + 2) = 0;\n GetLastError();\n }\n else {\n *(undefined1 *)(plVar13 + 2) = 1;\n plVar13[1] = (longlong)(1.0 / (double)local_278.QuadPart);\n }\n }\n plVar8 = DAT_140162d50;\n if ((undefined8 *)DAT_140162d50[2] != (undefined8 *)0x0) {\n (*(code *)**(undefined8 **)DAT_140162d50[2])();\n }\n plVar8[2] = (longlong)plVar13;\n if (plVar13 != (longlong *)0x0) {\n lVar20 = (**(code **)(*plVar13 + 8))(plVar13);\n plVar8[6] = lVar20;\n plVar8[7] = lVar20;\n }\n plVar8[0x12] = 0x3ff0000000000000;\n pwVar14 = operator_new(0x28);\n pwVar11 = pwVar19;\n local_260 = pwVar14;\n if (pwVar14 != (wchar_t *)0x0) {\n *(undefined ***)pwVar14 = Magi::Timer::vftable;\n plVar13 = DAT_140162d50;\n *(longlong **)(pwVar14 + 4) = DAT_140162d50;\n pwVar14[8] = L'\\0';\n pwVar14[9] = L'\\0';\n pwVar14[10] = L'\\0';\n pwVar14[0xb] = L'\\0';\n pwVar14[0xc] = L'\\0';\n pwVar14[0xd] = L'\\0';\n pwVar14[0xe] = L'\\0';\n pwVar14[0xf] = L'\\0';\n *(undefined1 *)(pwVar14 + 0x10) = 0;\n pwVar14[0x12] = L'\\0';\n pwVar14[0x13] = L'㾀';\n (**(code **)(*plVar13 + 0x10))();\n pwVar11 = pwVar14;\n }\n *(wchar_t **)(param_1 + 0x50) = pwVar11;\n bVar6 = true;\n local_238 = 0;\n memset(local_236,0,0x9e);\n puVar16 = (ulonglong *)0x0;\n puVar18 = (undefined2 *)0xa0;\n memset(local_198,0,0xa0);\n uVar21 = 0;\n uVar23 = 0;\n FUN_1400271e0(DAT_140162d68);\n pcVar15 = *(char **)(DAT_140162d58 + 8);\n do {\n pwVar11 = pwVar19;\n if (pcVar15 == *(char **)(DAT_140162d58 + 0x10)) {\nLAB_140003c4a:\n FUN_140009780(pwVar11);\n FUN_140001dc0(param_1 + 8);\n bVar7 = false;\n cVar3 = *(char *)(param_1 + 0x60);\n uVar24 = uVar21;\n uVar25 = uVar23;\n while (cVar3 != '\\0') {\n FUN_1400dc520((longlong)DAT_140162d50);\n dVar2 = *(double *)(*(longlong *)(param_1 + 0x50) + 0x10);\n if (((0.0 < *(double *)(DAT_140162d68 + 0x178)) &&\n (0.0 < dVar2 - *(double *)(DAT_140162d68 + 0x178))) && (bVar6)) {\n bVar6 = false;\n pcVar15 = \"Start Auto Server On. \\n\";\n printf(\"Start Auto Server On. \\n\");\n FUN_140009bd0(pcVar15,puVar16,puVar18,param_4);\n }\n FUN_140007da0(*(longlong *)(param_1 + 0xa8),dVar2);\n uVar22 = (undefined4)((ulonglong)dVar2 >> 0x20);\n if (1.0 <= dVar2 - (double)CONCAT44(uVar23,uVar21)) {\n if (DAT_140162cc4 != 0) {\n puVar16 = (ulonglong *)&DAT_14011b7b4;\n if (bVar7) {\n puVar16 = (ulonglong *)&DAT_14011b7b0;\n }\n puVar18 = (undefined2 *)(ulonglong)DAT_140162cc8;\n printf(\"[ %s ] FPS[ %d ]\\n\");\n bVar7 = !bVar7;\n }\n _DAT_140162ccc = DAT_140162cc8;\n DAT_140162cc8 = 0;\n uVar21 = SUB84(dVar2,0);\n uVar23 = uVar22;\n }\n if (0.10000000149011612 <= dVar2 - (double)CONCAT44(uVar25,uVar24)) {\n DAT_140162cc8 = DAT_140162cc8 + 1;\n FUN_140003f30(param_1,puVar16,puVar18,param_4);\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n FUN_1400053e0((longlong)pwVar11,dVar2);\n uVar24 = SUB84(dVar2,0);\n uVar25 = uVar22;\n }\n *(double *)(param_1 + 0x58) = dVar2;\n Sleep(1);\n cVar3 = *(char *)(param_1 + 0x60);\n }\n FUN_140010aa0(L\"+ Prepare Stop\\n\",puVar16,puVar18,param_4);\n FUN_1400079d0(*(longlong *)(param_1 + 0xa8));\n lVar20 = *(longlong *)(param_1 + 0xa0);\n puVar4 = *(undefined8 **)(lVar20 + 0x28);\n if (puVar4 != (undefined8 *)0x0) {\n puVar16 = (ulonglong *)0x1;\n (**(code **)*puVar4)();\n }\n *(undefined8 *)(lVar20 + 0x28) = 0;\n CoUninitialize();\n FUN_140010960(L\"# Agent Stoped... #\\n\",puVar16,puVar18,param_4);\n if (7 < local_b0) {\n operator_delete((void *)CONCAT62(uStack_c6,local_c8));\n }\n local_b0 = 7;\n local_b8 = 0;\n local_c8 = 0;\n if (7 < local_d8) {\n operator_delete((void *)CONCAT62(uStack_ee,local_f0));\n }\n pwVar19 = local_280;\n local_d8 = 7;\n local_e0 = 0;\n local_f0 = 0;\n if (pwVar10 != (wchar_t *)0x0) {\n plVar13 = (longlong *)((longlong)pwVar10 + 8);\n *plVar13 = *plVar13 + -1;\n plVar17 = local_288;\n if (*plVar13 == 0) {\n pwVar10 = *(wchar_t **)local_280;\n local_260 = pwVar10;\n if (pwVar10 != (wchar_t *)0x0) {\n FUN_14002e7a0((undefined4 *)(pwVar10 + 0x14),puVar16,puVar18,param_4);\n if (*(void **)(pwVar10 + 4) != (void *)0x0) {\n operator_delete(*(void **)(pwVar10 + 4));\n }\n pwVar10[4] = L'\\0';\n pwVar10[5] = L'\\0';\n pwVar10[6] = L'\\0';\n pwVar10[7] = L'\\0';\n pwVar10[8] = L'\\0';\n pwVar10[9] = L'\\0';\n pwVar10[10] = L'\\0';\n pwVar10[0xb] = L'\\0';\n pwVar10[0xc] = L'\\0';\n pwVar10[0xd] = L'\\0';\n pwVar10[0xe] = L'\\0';\n pwVar10[0xf] = L'\\0';\n operator_delete(pwVar10);\n }\n FUN_1400302f0(pwVar19);\n plVar17 = local_288;\n }\n }\n plVar13 = local_288;\n if (plVar17 != (longlong *)0x0) {\n plVar17 = plVar17 + 1;\n *plVar17 = *plVar17 + -1;\n if (*plVar17 == 0) {\n puVar4 = (undefined8 *)*local_288;\n if (puVar4 != (undefined8 *)0x0) {\n (**(code **)*puVar4)(puVar4,1);\n }\n FUN_1400302f0(plVar13);\n }\n }\n return 0;\n }\n if (*pcVar15 == '\\x18') {\n pwVar11 = (wchar_t *)(pcVar15 + 8);\n if (7 < *(ulonglong *)(pcVar15 + 0x20)) {\n pwVar11 = *(wchar_t **)(pcVar15 + 8);\n }\n goto LAB_140003c4a;\n }\n pcVar15 = pcVar15 + 0x30;\n } while( true );\n}\n\n","operation":"procedure_pseudo_code","parameters":{"procedure":"0x1400037a0"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":{"limitations":[],"value":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */\n\nundefined8 FUN_1400037a0(longlong param_1,undefined8 **param_2,undefined8 *param_3,uint *param_4)\n\n{\n int *piVar1;\n double dVar2;\n char cVar3;\n undefined8 *puVar4;\n undefined1 auVar5 [16];\n bool bVar6;\n bool bVar7;\n longlong *plVar8;\n BOOL BVar9;\n wchar_t *pwVar10;\n wchar_t *pwVar11;\n ulonglong uVar12;\n longlong *plVar13;\n wchar_t *pwVar14;\n char *pcVar15;\n ulonglong *puVar16;\n longlong *plVar17;\n undefined2 *puVar18;\n wchar_t *pwVar19;\n longlong lVar20;\n undefined4 uVar21;\n undefined4 uVar22;\n undefined4 uVar23;\n undefined4 uVar24;\n undefined4 uVar25;\n undefined1 auStack_2a8 [32];\n longlong *local_288;\n wchar_t *local_280;\n LARGE_INTEGER local_278;\n undefined8 *local_270;\n wchar_t *local_268;\n wchar_t *local_260;\n int *local_258;\n undefined1 local_250;\n undefined8 local_248;\n undefined2 local_238;\n undefined1 local_236 [158];\n undefined1 local_198 [160];\n undefined8 *local_f8;\n undefined2 local_f0;\n undefined6 uStack_ee;\n undefined8 local_e0;\n ulonglong local_d8;\n undefined2 local_c8;\n undefined6 uStack_c6;\n undefined8 local_b8;\n ulonglong local_b0;\n ulonglong local_98;\n \n local_248 = 0xfffffffffffffffe;\n local_98 = DAT_1401555a0 ^ (ulonglong)auStack_2a8;\n FUN_140010960(L\"# Agent Startup #\\n\\n\",param_2,param_3,param_4);\n CoInitialize((LPVOID)0x0);\n FUN_140010aa0(L\"+ Prepare Startup\\n\",param_2,param_3,param_4);\n local_278 = (LARGE_INTEGER)operator_new(0xb8);\n pwVar19 = (wchar_t *)0x0;\n pwVar10 = pwVar19;\n if ((undefined8 *)local_278.QuadPart != (undefined8 *)0x0) {\n pwVar10 = (wchar_t *)FUN_140005020((undefined8 *)local_278,param_2,param_3,param_4);\n }\n if (pwVar10 == (wchar_t *)0x0) {\n local_288 = (longlong *)0x0;\n }\n else {\n local_288 = (longlong *)FUN_140030280(0x10);\n local_288[1] = 1;\n *local_288 = (longlong)pwVar10;\n }\n plVar17 = local_288;\n pwVar11 = operator_new(0x68);\n pwVar10 = pwVar19;\n local_280 = pwVar11;\n if (pwVar11 != (wchar_t *)0x0) {\n if (plVar17 != (longlong *)0x0) {\n pwVar10 = (wchar_t *)*plVar17;\n }\n *(wchar_t **)pwVar11 = pwVar10;\n pwVar11[4] = L'\\0';\n pwVar11[5] = L'\\0';\n pwVar11[6] = L'\\0';\n pwVar11[7] = L'\\0';\n pwVar11[8] = L'\\0';\n pwVar11[9] = L'\\0';\n pwVar11[10] = L'\\0';\n pwVar11[0xb] = L'\\0';\n pwVar11[0xc] = L'\\0';\n pwVar11[0xd] = L'\\0';\n pwVar11[0xe] = L'\\0';\n pwVar11[0xf] = L'\\0';\n uVar12 = FUN_14002e790();\n param_2 = (undefined8 **)(uVar12 & 0xffffffff);\n param_3 = (undefined8 *)CONCAT71((int7)((ulonglong)param_3 >> 8),1);\n FUN_14002e600((undefined4 *)(pwVar11 + 0x14),(ulonglong)param_2,param_3,param_4);\n FUN_140007960((longlong)pwVar11);\n pwVar10 = pwVar11;\n }\n if (pwVar10 == (wchar_t *)0x0) {\n local_280 = (wchar_t *)0x0;\n }\n else {\n local_280 = (wchar_t *)FUN_140030280(0x10);\n *(undefined8 *)((longlong)local_280 + 8) = 1;\n *(wchar_t **)local_280 = pwVar10;\n }\n pwVar10 = local_280;\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n *(wchar_t **)(param_1 + 0xa0) = pwVar11;\n pwVar11 = pwVar19;\n if (local_280 != (wchar_t *)0x0) {\n pwVar11 = *(wchar_t **)local_280;\n }\n *(wchar_t **)(param_1 + 0xa8) = pwVar11;\n pwVar11 = pwVar19;\n if (local_280 != (wchar_t *)0x0) {\n pwVar11 = *(wchar_t **)local_280;\n }\n FUN_140007960((longlong)pwVar11);\n local_f8 = (undefined8 *)0x0;\n local_d8 = 7;\n local_e0 = 0;\n local_f0 = 0;\n local_b0 = 7;\n local_b8 = 0;\n local_c8 = 0;\n if (*(longlong *)(DAT_140162d68 + 0x1c8) != 0) {\n auVar5._8_8_ = 0;\n auVar5._0_8_ = *(ulonglong *)(DAT_140162d68 + 0x1b0);\n param_2 = SUB168((ZEXT816(0) << 0x40 | ZEXT816(0x15)) % auVar5,0);\n local_270 = (undefined8 *)(*(longlong *)(DAT_140162d68 + 0x1a8) + (longlong)param_2 * 8);\n for (local_268 = (wchar_t *)*local_270; local_268 != (wchar_t *)0x0;\n local_268 = *(wchar_t **)local_268) {\n if ((char)local_268[4] == '\\x15') {\n if (local_268 != (wchar_t *)0x0) goto LAB_1400039c4;\n break;\n }\n }\n }\n local_270 = (undefined8 *)0x0;\n local_268 = pwVar19;\nLAB_1400039c4:\n if ((local_268 != (wchar_t *)0x0) &&\n (puVar4 = *(undefined8 **)(local_268 + 8), puVar4 != *(undefined8 **)(local_268 + 0xc))) {\n local_f8 = (undefined8 *)*puVar4;\n FUN_140001600((longlong *)&local_f0,puVar4 + 1,0,0xffffffffffffffff);\n param_4 = (uint *)0xffffffffffffffff;\n param_3 = (undefined8 *)0x0;\n FUN_140001600((longlong *)&local_c8,puVar4 + 6,0,0xffffffffffffffff);\n param_2 = &local_f8;\n FUN_140007a80(*(undefined8 **)(param_1 + 0xa8),param_2,param_3,(undefined8 *)param_4);\n lVar20 = *(longlong *)(param_1 + 0xa8);\n piVar1 = (int *)(lVar20 + 0x28);\n local_258 = piVar1;\n FUN_14002e6e0(piVar1);\n plVar13 = *(longlong **)(lVar20 + 8);\n if (*plVar13 == 0) {\n FUN_14002e770((longlong)piVar1);\n local_250 = 0;\n }\n else {\n lVar20 = *plVar13;\n FUN_14002e770((longlong)piVar1);\n local_250 = 0;\n if (lVar20 != 0) {\n cVar3 = *(char *)(lVar20 + 0x88);\n while (cVar3 == '\\0') {\n FUN_1400023e0(lVar20);\n cVar3 = *(char *)(lVar20 + 0x88);\n }\n }\n }\n }\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n FUN_140005360((longlong)pwVar11,param_2,param_3,(longlong)param_4);\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n *(undefined8 *)(pwVar11 + 0x24) = *(undefined8 *)(param_1 + 0xa8);\n FUN_140010960(L\"\\n # Agent Running... #\\n\",param_2,param_3,param_4);\n plVar13 = operator_new(0x18);\n if (plVar13 == (longlong *)0x0) {\n plVar13 = (longlong *)0x0;\n }\n else {\n *plVar13 = (longlong)TimeSourceHRWin32::vftable;\n BVar9 = QueryPerformanceFrequency(&local_278);\n if (BVar9 == 0) {\n *(undefined1 *)(plVar13 + 2) = 0;\n GetLastError();\n }\n else {\n *(undefined1 *)(plVar13 + 2) = 1;\n plVar13[1] = (longlong)(1.0 / (double)local_278.QuadPart);\n }\n }\n plVar8 = DAT_140162d50;\n if ((undefined8 *)DAT_140162d50[2] != (undefined8 *)0x0) {\n (*(code *)**(undefined8 **)DAT_140162d50[2])();\n }\n plVar8[2] = (longlong)plVar13;\n if (plVar13 != (longlong *)0x0) {\n lVar20 = (**(code **)(*plVar13 + 8))(plVar13);\n plVar8[6] = lVar20;\n plVar8[7] = lVar20;\n }\n plVar8[0x12] = 0x3ff0000000000000;\n pwVar14 = operator_new(0x28);\n pwVar11 = pwVar19;\n local_260 = pwVar14;\n if (pwVar14 != (wchar_t *)0x0) {\n *(undefined ***)pwVar14 = Magi::Timer::vftable;\n plVar13 = DAT_140162d50;\n *(longlong **)(pwVar14 + 4) = DAT_140162d50;\n pwVar14[8] = L'\\0';\n pwVar14[9] = L'\\0';\n pwVar14[10] = L'\\0';\n pwVar14[0xb] = L'\\0';\n pwVar14[0xc] = L'\\0';\n pwVar14[0xd] = L'\\0';\n pwVar14[0xe] = L'\\0';\n pwVar14[0xf] = L'\\0';\n *(undefined1 *)(pwVar14 + 0x10) = 0;\n pwVar14[0x12] = L'\\0';\n pwVar14[0x13] = L'㾀';\n (**(code **)(*plVar13 + 0x10))();\n pwVar11 = pwVar14;\n }\n *(wchar_t **)(param_1 + 0x50) = pwVar11;\n bVar6 = true;\n local_238 = 0;\n memset(local_236,0,0x9e);\n puVar16 = (ulonglong *)0x0;\n puVar18 = (undefined2 *)0xa0;\n memset(local_198,0,0xa0);\n uVar21 = 0;\n uVar23 = 0;\n FUN_1400271e0(DAT_140162d68);\n pcVar15 = *(char **)(DAT_140162d58 + 8);\n do {\n pwVar11 = pwVar19;\n if (pcVar15 == *(char **)(DAT_140162d58 + 0x10)) {\nLAB_140003c4a:\n FUN_140009780(pwVar11);\n FUN_140001dc0(param_1 + 8);\n bVar7 = false;\n cVar3 = *(char *)(param_1 + 0x60);\n uVar24 = uVar21;\n uVar25 = uVar23;\n while (cVar3 != '\\0') {\n FUN_1400dc520((longlong)DAT_140162d50);\n dVar2 = *(double *)(*(longlong *)(param_1 + 0x50) + 0x10);\n if (((0.0 < *(double *)(DAT_140162d68 + 0x178)) &&\n (0.0 < dVar2 - *(double *)(DAT_140162d68 + 0x178))) && (bVar6)) {\n bVar6 = false;\n pcVar15 = \"Start Auto Server On. \\n\";\n printf(\"Start Auto Server On. \\n\");\n FUN_140009bd0(pcVar15,puVar16,puVar18,param_4);\n }\n FUN_140007da0(*(longlong *)(param_1 + 0xa8),dVar2);\n uVar22 = (undefined4)((ulonglong)dVar2 >> 0x20);\n if (1.0 <= dVar2 - (double)CONCAT44(uVar23,uVar21)) {\n if (DAT_140162cc4 != 0) {\n puVar16 = (ulonglong *)&DAT_14011b7b4;\n if (bVar7) {\n puVar16 = (ulonglong *)&DAT_14011b7b0;\n }\n puVar18 = (undefined2 *)(ulonglong)DAT_140162cc8;\n printf(\"[ %s ] FPS[ %d ]\\n\");\n bVar7 = !bVar7;\n }\n _DAT_140162ccc = DAT_140162cc8;\n DAT_140162cc8 = 0;\n uVar21 = SUB84(dVar2,0);\n uVar23 = uVar22;\n }\n if (0.10000000149011612 <= dVar2 - (double)CONCAT44(uVar25,uVar24)) {\n DAT_140162cc8 = DAT_140162cc8 + 1;\n FUN_140003f30(param_1,puVar16,puVar18,param_4);\n pwVar11 = pwVar19;\n if (plVar17 != (longlong *)0x0) {\n pwVar11 = (wchar_t *)*plVar17;\n }\n FUN_1400053e0((longlong)pwVar11,dVar2);\n uVar24 = SUB84(dVar2,0);\n uVar25 = uVar22;\n }\n *(double *)(param_1 + 0x58) = dVar2;\n Sleep(1);\n cVar3 = *(char *)(param_1 + 0x60);\n }\n FUN_140010aa0(L\"+ Prepare Stop\\n\",puVar16,puVar18,param_4);\n FUN_1400079d0(*(longlong *)(param_1 + 0xa8));\n lVar20 = *(longlong *)(param_1 + 0xa0);\n puVar4 = *(undefined8 **)(lVar20 + 0x28);\n if (puVar4 != (undefined8 *)0x0) {\n puVar16 = (ulonglong *)0x1;\n (**(code **)*puVar4)();\n }\n *(undefined8 *)(lVar20 + 0x28) = 0;\n CoUninitialize();\n FUN_140010960(L\"# Agent Stoped... #\\n\",puVar16,puVar18,param_4);\n if (7 < local_b0) {\n operator_delete((void *)CONCAT62(uStack_c6,local_c8));\n }\n local_b0 = 7;\n local_b8 = 0;\n local_c8 = 0;\n if (7 < local_d8) {\n operator_delete((void *)CONCAT62(uStack_ee,local_f0));\n }\n pwVar19 = local_280;\n local_d8 = 7;\n local_e0 = 0;\n local_f0 = 0;\n if (pwVar10 != (wchar_t *)0x0) {\n plVar13 = (longlong *)((longlong)pwVar10 + 8);\n *plVar13 = *plVar13 + -1;\n plVar17 = local_288;\n if (*plVar13 == 0) {\n pwVar10 = *(wchar_t **)local_280;\n local_260 = pwVar10;\n if (pwVar10 != (wchar_t *)0x0) {\n FUN_14002e7a0((undefined4 *)(pwVar10 + 0x14),puVar16,puVar18,param_4);\n if (*(void **)(pwVar10 + 4) != (void *)0x0) {\n operator_delete(*(void **)(pwVar10 + 4));\n }\n pwVar10[4] = L'\\0';\n pwVar10[5] = L'\\0';\n pwVar10[6] = L'\\0';\n pwVar10[7] = L'\\0';\n pwVar10[8] = L'\\0';\n pwVar10[9] = L'\\0';\n pwVar10[10] = L'\\0';\n pwVar10[0xb] = L'\\0';\n pwVar10[0xc] = L'\\0';\n pwVar10[0xd] = L'\\0';\n pwVar10[0xe] = L'\\0';\n pwVar10[0xf] = L'\\0';\n operator_delete(pwVar10);\n }\n FUN_1400302f0(pwVar19);\n plVar17 = local_288;\n }\n }\n plVar13 = local_288;\n if (plVar17 != (longlong *)0x0) {\n plVar17 = plVar17 + 1;\n *plVar17 = *plVar17 + -1;\n if (*plVar17 == 0) {\n puVar4 = (undefined8 *)*local_288;\n if (puVar4 != (undefined8 *)0x0) {\n (**(code **)*puVar4)(puVar4,1);\n }\n FUN_1400302f0(plVar13);\n }\n }\n return 0;\n }\n if (*pcVar15 == '\\x18') {\n pwVar11 = (wchar_t *)(pcVar15 + 8);\n if (7 < *(ulonglong *)(pcVar15 + 0x20)) {\n pwVar11 = *(wchar_t **)(pcVar15 + 8);\n }\n goto LAB_140003c4a;\n }\n pcVar15 = pcVar15 + 0x30;\n } while( true );\n}\n\n"},"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"3decca45d3460a9d91b48bfb293ee703f84841379edceee6350b1ea3393d3fe1","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":3},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_3112fedf5c049bd61bb69c82f6a28159baae728170411100d85d5a503537d804","evidence_links":[],"limitations":["Derived by an REA composed workflow.","A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB MessageServer_Release_x64.pdb (GUID cde07e33-d76f-49e7-887c-43afecaef251, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"document":"target-7911b15c4379.exe","image_base":"0x140000000","procedure_count":7728,"segment_count":9,"segments":[{"address_space":"ram","end":"0x140000400","image_base":"0x140000000","length":1024,"name":"Headers","start":"0x140000000"},{"address_space":"ram","end":"0x14012fa00","image_base":"0x140000000","length":1239552,"name":".text","start":"0x140001000"},{"address_space":"ram","end":"0x1401ab600","image_base":"0x140000000","length":505344,"name":".rdata","start":"0x140130000"},{"address_space":"ram","end":"0x1401bd7b0","image_base":"0x140000000","length":71600,"name":".data","start":"0x1401ac000"},{"address_space":"ram","end":"0x1401cb200","image_base":"0x140000000","length":53760,"name":".pdata","start":"0x1401be000"},{"address_space":"ram","end":"0x1401cc200","image_base":"0x140000000","length":512,"name":".tls","start":"0x1401cc000"},{"address_space":"ram","end":"0x1401cd200","image_base":"0x140000000","length":512,"name":".rsrc","start":"0x1401cd000"},{"address_space":"ram","end":"0x1401d2000","image_base":"0x140000000","length":16384,"name":".reloc","start":"0x1401ce000"},{"address_space":"ram","end":"0xff00001850","image_base":"0x140000000","length":6224,"name":"tdb","start":"0xff00000000"}],"string_count":1803},"operation":"binary_overview","parameters":{},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/MessageServer_Release_x64.exe","name":"MessageServer_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_37c60dfdda40ba0a32a0292ddecc48812ecb8a843c45994b5dd53fe367ef830e","evidence_links":[],"limitations":["Derived by an REA composed workflow.","An exact external entry resolves to its observed function identity even when its body is empty. This does not establish mapped executable bytes or containment of nearby external addresses.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","Synthetic Ghidra entry-point references without actionable memory sources are omitted.","The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"matches":[{"address":"0x14011af70","type":"string","value":"Global\\RustyHearts_Agent"}],"query":"RustyHearts_Agent","references":[{"containing_procedure":{"found":true,"procedure":{"address":"0x1400100b0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140010119","start":"0x1400100b0"}],"span_bytes":106,"total_bytes":106},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_1400100b0"},"query_address":"0x1400100b9"},"source_address":"0x1400100b9","target_address":"0x14011af70"},{"containing_procedure":{"found":true,"procedure":{"address":"0x1400100b0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x140010119","start":"0x1400100b0"}],"span_bytes":106,"total_bytes":106},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_1400100b0"},"query_address":"0x1400100fa"},"source_address":"0x1400100fa","target_address":"0x14011af70"}],"residual_unknowns":[],"search_mode":"literal","truncated":false},"operation":"trace_feature","parameters":{"case_sensitive":true,"query":"RustyHearts_Agent"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_47e1666c2b642892bcc0c19fd01c2f4ff5568b8abac06a01dd98d997d3c40584","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":[{"address":"0x1400f3358","value":"GetLogicalProcessorInformation"},{"address":"0x1400f3488","value":"CreateIoCompletionPort"},{"address":"0x1400f3ea0","value":" HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.3.154.9 Safari/525.19\r\nAccept-Language: ko-KR,ko,en-US,en\r\nAccept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\nCache-Control: max-age=0\r\nAccept-Charset: EUC-KR,*,utf-8\r\nAccept-Encoding: gzip,deflate,bzip2\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n"},{"address":"0x1400f4048","value":"GET /PNReport/ReportError.php?Text="},{"address":"0x1400f4258","value":"**ErrorReport** "},{"address":"0x1400f4370","value":"ErrReporter"},{"address":"0x1400f4928","value":"Proud::CFastSocket::Connect"},{"address":"0x1400f4b70","value":"Proud::CFastSocket::Listen"},{"address":"0x1400f4d60","value":"This socket doesn't support TTL change!"},{"address":"0x1400f4db0","value":"Sending to prohibited port is not permitted!"},{"address":"0x1400f55f0","value":"CListNode reports a consistency problem at %s !"},{"address":"0x1400f5800","value":"Proud::CompletionPort::AssociateSocket"},{"address":"0x1400f6630","value":"Too large message is detected. Contact technical supports."},{"address":"0x1400f66b0","value":"Invalid packet format. Remote host is hacked or has a bug."},{"address":"0x1400f67a0","value":"Client-server UDP comm is blocked."},{"address":"0x1400f6aa0","value":"Server socket listen failure. Make sure that the TCP or UDP listening port is not already in use."},{"address":"0x1400f6b68","value":"Server is not ready."},{"address":"0x1400f6c18","value":"Local host disconnected."},{"address":"0x1400f6c50","value":"Remote host disconnected."},{"address":"0x1400f6c90","value":"Connecting to server successful."},{"address":"0x1400f6ce0","value":"Server denied connection attempt."},{"address":"0x1400f6d78","value":"Connect to server timed out."},{"address":"0x1400f6e68","value":"TCP connection failure."},{"address":"0x1400f6e98","value":"Already connected."},{"address":"0x1400f7680","value":"Not supported value yet!"},{"address":"0x1400f7ab0","value":"Proud::CNetServerImpl::GetP2PGroupCount"},{"address":"0x1400f7e40","value":"Proud::CNetServerImpl::GetClientCount"},{"address":"0x1400f7ec0","value":"Proud::CNetServerImpl::SetDefaultTimeoutTimeSec"},{"address":"0x1400f7f20","value":"Too long timeout value. It may take a lot of time to detect lost connection."},{"address":"0x1400f7fc0","value":"Too short timeout value. It may cause unfair disconnection."},{"address":"0x1400f8070","value":"Proud::CNetServerImpl::SetDirectP2PStartCondition"},{"address":"0x1400f8140","value":"Cannot set AllowEmptyP2PGroup after the server has started."},{"address":"0x1400f81c0","value":"Proud::CNetServerImpl::AllowEmptyP2PGroup"},{"address":"0x1400f8280","value":"Proud::CNetServerImpl::SetHostTag"},{"address":"0x1400f8500","value":"Proud::CNetServerImpl::GetJoinedP2PGroups"},{"address":"0x1400f8590","value":"Proud::CNetServerImpl::CloseEveryConnection"},{"address":"0x1400f8620","value":"Proud::CNetServerImpl::GetLastPingSec"},{"address":"0x1400f86a0","value":"Proud::CNetServerImpl::GetRecentPingSec"},{"address":"0x1400f8720","value":"Proud::CNetServerImpl::GetClientHostIDs"},{"address":"0x1400f87a0","value":"Proud::CNetServerImpl::GetClientInfo"},{"address":"0x1400f8820","value":"Proud::CNetServerImpl::TcpAndUdp_DoForLongInterval"},{"address":"0x1400f88f0","value":"Proud::CNetServerImpl::EnableLog"},{"address":"0x1400f8970","value":"Proud::CNetServerImpl::DisableLog"},{"address":"0x1400f89f0","value":"Proud::CNetServerImpl::GetStats"},{"address":"0x1400f8a60","value":"Cannot call GetUdpListenerLocalAddrs unless ServerUdpAssignMode_Static is used!"},{"address":"0x1400f8b00","value":"Proud::CNetServerImpl::GetUdpListenerLocalAddrs"},{"address":"0x1400f8b90","value":"Proud::CNetServerImpl::NextEncryptCount"},{"address":"0x1400f8c10","value":"Proud::CNetServerImpl::PrevEncryptCount"},{"address":"0x1400f8c90","value":"Proud::CNetServerImpl::GetExpectedDecryptCount"},{"address":"0x1400f8d20","value":"Proud::CNetServerImpl::NextDecryptCount"},{"address":"0x1400f8da0","value":"Proud::CNetServerImpl::IsConnectedClient"},{"address":"0x1400f8e30","value":"Proud::CNetServerImpl::EnableSpeedHackDetector"},{"address":"0x1400f8ec0","value":"Proud::CNetServerImpl::SetMaxDirectP2PConnectionCount"},{"address":"0x1400f8f90","value":"Cannot call GetUdpSocketAddrList unless ServerUdpAssignMode_Static is used!"},{"address":"0x1400f9030","value":"Proud::CNetServerImpl::GetUdpSocketAddrList"},{"address":"0x1400f9090","value":"Proud::CNetServerImpl::GetTaskSubjectByHostID_NOLOCK"},{"address":"0x1400f9940","value":"Proud::CNetServerImpl::C2SStub::NotifyNatDeviceNameDetected"},{"address":"0x1400f99f0","value":"Proud::CNetServerImpl::C2SStub::NotifySendSpeed"},{"address":"0x1400f9aa0","value":"Proud::CNetServerImpl::C2SStub::NotifyLog"},{"address":"0x1400f9bd0","value":"Proud::CNetServerImpl::C2SStub::NotifyLogHolepunchFreqFail"},{"address":"0x1400f9c80","value":"Proud::CNetServerImpl::C2SStub::ReliablePing"},{"address":"0x1400f9d10","value":"Proud::CNetServerImpl::C2SStub::ShutdownTcp"},{"address":"0x1400f9da0","value":"Proud::CNetServerImpl::C2SStub::NotifyNatDeviceName"},{"address":"0x1400f9e40","value":"Proud::CNetServerImpl::C2SStub::ReportP2PPeerPing"},{"address":"0x1400f9ee0","value":"Proud::CNetServerImpl::C2SStub::ReportC2CUdpMessageCount"},{"address":"0x1400f9f90","value":"Proud::CNetServerImpl::C2SStub::ReportC2SUdpMessageTrialCount"},{"address":"0x1400fa040","value":"Proud::CNetServerImpl::PurgeTooOldUnmatureClient"},{"address":"0x1400fa0e0","value":"%d remote rc is %s in netserver!"},{"address":"0x1400fa170","value":"Proud::CNetServerImpl::GetCryptSessionKey"},{"address":"0x1400fa260","value":"Proud::CNetServerImpl::CloseConnection"},{"address":"0x1400fa2e0","value":"Proud::CNetServerImpl::GetP2PRecentPing"},{"address":"0x1400fa370","value":"Proud::CNetServerImpl::GetP2PConnectionStats"},{"address":"0x1400fa490","value":"Proud::CNetServerImpl::ElectSuperPeer"},{"address":"0x1400fa570","value":"Proud::CNetServerImpl::GetUserWorkerThreadInfo"},{"address":"0x1400fa600","value":"Proud::CNetServerImpl::GetNetWorkerThreadInfo"},{"address":"0x1400fa6c0","value":"NetServer udpIssueQueueCS DeadLock!! - %s"},{"address":"0x1400fa720","value":"NetServer tcpIssueQueueCS DeadLock!! - %s"},{"address":"0x1400faa00","value":"Proud::CNetServerImpl::C2SStub::C2S_CreateUdpSocketAck"},{"address":"0x1400fac00","value":"Proud::CNetServerImpl::C2SStub::NotifyUdpToTcpFallbackByClient"},{"address":"0x1400fae20","value":"Proud::CNetServerImpl::C2SStub::NotifyP2PHolepunchSuccess"},{"address":"0x1400faf20","value":"Proud::CNetServerImpl::C2SStub::P2P_NotifyDirectP2PDisconnected"},{"address":"0x1400fb070","value":"Proud::CNetServerImpl::C2SStub::NotifyPeerUdpSocketRestored"},{"address":"0x1400fb1c0","value":"Proud::CNetServerImpl::EnquePacketDefragWarning"},{"address":"0x1400fb480","value":"Proud::CNetServerImpl::CreateAndInitUdpSockets"},{"address":"0x1400fb570","value":"All UDP port numbers specified at Server Start are deleted! An arbitary port number is assigned instead."},{"address":"0x1400fb870","value":"Proud::CNetServerImpl::C2SStub::NotifyJitDirectP2PTriggered"},{"address":"0x1400fb920","value":"Proud::CNetServerImpl::C2SStub::C2S_RequestCreateUdpSocket"},{"address":"0x1400fb9d0","value":"CStartServerParameter::m_fastEncryptedMessageKeyLength Incorrect key lengt, MaxSize is 2048, MinSize is 8"},{"address":"0x1400fba40","value":"CStartServerParameter::m_encryptedMessageKeyLength Incorrect key length, only 128,192,256"},{"address":"0x1400fbaa0","value":"No NIC binding though multiple NIC detected##Process=%s"},{"address":"0x1400fbb10","value":"Server has multiple network devices, however, no device is specified for listening. Is it your intention?"},{"address":"0x1400fbbf0","value":"Cannot add duplicated UDP port number!"},{"address":"0x1400fbc70","value":"Cannot assign non-zero UDP port number with zero UDP port number! All non-zero or all zero must be guaranteed!"},{"address":"0x1400fbff0","value":"Proud::CNetServerImpl::GetP2PGroupInfo"},{"address":"0x1400fc0a0","value":"Proud::CNetServerImpl::GetMostSuitableSuperPeerInGroup"},{"address":"0x1400fc110","value":"Proud::CNetServerImpl::IsValidHostID_NOLOCK"},{"address":"0x1400fc1a0","value":"Proud::CNetServerImpl::GetSuitableSuperPeerRankListInGroup"},{"address":"0x1400fc420","value":"Proud::CNetServerImpl::ProcessOneLocalEvent"},{"address":"0x1400fc5e0","value":"Proud::CNetServerImpl::Send_BroadcastLayer"},{"address":"0x1400fcba0","value":"Proud::CNetServerImpl::C2SStub::P2PGroup_MemberJoin_Ack"},{"address":"0x1400fcc40","value":"Proud::CNetServerImpl::GetP2PGroups"},{"address":"0x1400fccc0","value":"Proud::CNetServerImpl::PurgeTooOldAddMemberAckItem"},{"address":"0x1400fce50","value":"Proud::CNetServerImpl::JoinP2PGroup"},{"address":"0x1400fced0","value":"Proud::CNetServerImpl::EnqueueHackSuspectEvent"},{"address":"0x1400fcf60","value":"Proud::CNetServerImpl::EnqueueP2PGroupRemoveEvent"},{"address":"0x1400fd000","value":"Proud::CNetServerImpl::EnqueueUnitTestFailEvent"},{"address":"0x1400fd1c8","value":"AddrPort.IsSameLan fail!"},{"address":"0x1400fd250","value":"Proud::CNetServerImpl::EnqueError"},{"address":"0x1400fd2d0","value":"Proud::CNetServerImpl::EnqueWarning"},{"address":"0x1400fd380","value":"Proud::CNetServerImpl::DestroyP2PGroup"},{"address":"0x1400fd400","value":"Proud::CNetServerImpl::LeaveP2PGroup"},{"address":"0x1400fd4d0","value":"Proud::CNetServerImpl::CreateP2PGroup"},{"address":"0x1400fd600","value":"Proud::CNetServerImpl::DestroyEmptyP2PGroups"},{"address":"0x1400fd710","value":"Proud::CNetServerImpl::TestReliableUdpFrame"},{"address":"0x1400fd7a0","value":"Proud::CNetServerImpl::HardDisconnect_AutoPruneGoesTooLongClient"},{"address":"0x1400fd860","value":"Proud::CNetServerImpl::C2SStub::ShutdownTcpHandshake"},{"address":"0x1400fd928","value":"Proud::CNetServerImpl::Stop"},{"address":"0x1400fd990","value":"Proud::CNetServerImpl::DisposeIssuedRemoteClients"},{"address":"0x1400fda30","value":"Proud::CNetServerImpl::~CNetServerImpl"},{"address":"0x1400fdab0","value":"Proud::CNetServerImpl::HeartBeat_PerClient"},{"address":"0x1400fdb40","value":"Cannot send messages unless connection to server exists!"},{"address":"0x1400ffc00","value":"Received stream from TCP server became inconsistent!"},{"address":"0x1400ffc98","value":"Sending ServerHolepunch: %s"},{"address":"0x140100320","value":"Unstability in Connect #1! Process=%s"},{"address":"0x140100370","value":"Unstability in Connect #3! Process=%s"},{"address":"0x1401003c0","value":"Wrong state(%s)! Disconnect() or GetServerConnectionState() may be required."},{"address":"0x140100c80","value":"Unstability in Disconnect #1! Process=%s"},{"address":"0x140100ce0","value":"Unstability in Disconnect #2! Process=%s"},{"address":"0x140100d40","value":"CNetClient.Disconnect seems to be freezed ## State=%d##GarbageCount=%d##Process=%s"},{"address":"0x140100ec0","value":"(first chance) to-server UDP punch lost##Reason:%d##CliInstCount=%d##RecentElapTime=%3.3f##DisconnedCount=%d##recv count=%d##last ok recv interval=%3.3f##Recurred:%d##LocalIP:%s##UDP kept time:%3.3f##Time diff since RecvIssue:%3.3f##NAT name=%s##%s##Process=%s"},{"address":"0x1401016d0","value":"RMI Proxy which is still in use by ProudNet core cannot be destroyed! Destroy CNetClient or CNetServer instance first."},{"address":"0x140101840","value":"Already async callback may occur! server start or client connection should have not been done before here!"},{"address":"0x140101c90","value":"CStartServerParameter.m_enableP2PEncryptedMessaging=false. P2P Messaging can not encrypted!!"},{"address":"0x140101ee0","value":"Proud::CNetCoreImpl::ProcessMessage_Encrypted"},{"address":"0x140101f70","value":"Packet compression failed! Error code=%d"},{"address":"0x140102030","value":"RMI Stub which is still in use by ProudNet core cannot be destroyed! Destroy CNetClient or CNetServer instance first."},{"address":"0x1401022f0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_SpeedHackDetectorPing"},{"address":"0x1401023b0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ReplyReceiveSpeedAtReceiverSide_NoBypass"},{"address":"0x1401027b4","value":": Client local Addr=%s,Client addr at server=%s"},{"address":"0x140102820","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_NotifyHolepunchSuccess"},{"address":"0x1401029a0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_PeerUdp_NotifyHolepunchSuccess"},{"address":"0x140102a70","value":"MessageType_ServerHolepunch from %s"},{"address":"0x140102ac0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ServerHolepunch"},{"address":"0x140102b80","value":"MessageType_PeerUdp_ServerHolepunch from %s"},{"address":"0x140102be0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_PeerUdp_ServerHolepunch"},{"address":"0x140102cc0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ReliableRelay1"},{"address":"0x140102db0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_UnreliableRelay1"},{"address":"0x140102e40","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_UnreliableRelay1"},{"address":"0x140102eb0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_LingerDataFrame1"},{"address":"0x140102f40","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_LingerDataFrame1"},{"address":"0x140102ff0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_RequestServerTimeAndKeepAlive"},{"address":"0x1401030f0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_RequestReceiveSpeedAtReceiverSide_NoBypass"},{"address":"0x1401031f0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_NotifyServerConnectionRequestData"},{"address":"0x1401034b0","value":"Proud::CNetThreads_S::TcpListenerProc_DoAcceptedSocket"},{"address":"0x1401037d0","value":"Proud::CNetThreads_S::NetworkerThread_ProcessMessage_NotifyCSEncryptedSessionKey"},{"address":"0x140103a00","value":"Proud::CNetThreads_S::TcpListenerProc"},{"address":"0x140103b18","value":"PNSrv TcpListener"},{"address":"0x140103ba0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_Rmi"},{"address":"0x140103c40","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_UserMessage"},{"address":"0x140103cf0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ProudNetLayer"},{"address":"0x140104410","value":"ServerSocketPool is already destructed!"},{"address":"0x140108308","value":"NotifyCli_ConnectionState"},{"address":"0x140109510","value":"Proud::CListNode::CListOwner::Erase"},{"address":"0x140109590","value":"Proud::CListNode::CListOwner::Erase"},{"address":"0x1401096b0","value":"Unexpected at PacketQueue Pop!"},{"address":"0x140109840","value":"Unexpected state in RemoteToPacketSendMap #2!"},{"address":"0x1401098a0","value":"Unexpected state in RemoteToPacketSendMap!"},{"address":"0x140109a60","value":"PacketQueue consistency failed!"},{"address":"0x140109aa0","value":"PacketQueue consistency 2 failed!"},{"address":"0x140109b10","value":"UDP frag length is wrong #1! packetlength=%d, maxlength=%d, fragID=%d"},{"address":"0x140109c20","value":"UDP frag length is wrong #3! assembledDataCount=%d, packetLength=%d"},{"address":"0x140109d40","value":"UDP full packet length is wrong!"},{"address":"0x140109d90","value":"Cannot identify UDP fragment nor full packet! fragheaderSplitter=%u"},{"address":"0x14010a260","value":"Disconnected"},{"address":"0x14010a280","value":"Connecting"},{"address":"0x14010a298","value":"Connected"},{"address":"0x14010a2b0","value":"Disconnecting"},{"address":"0x14010a2d0","value":""},{"address":"0x14010a890","value":"FastEncrypt Key Length is 0, Check ServerStartParameters m_fastEncryptedMessageKeyLength"},{"address":"0x14010abc8","value":"PUBLIC KEY EXPORT ERROR"},{"address":"0x14010adc8","value":"Incorrect Packet"},{"address":"0x14010b300","value":"CNetClientManager.dtor assert fail: %d %d"},{"address":"0x14010b4f0","value":"Message_ServerHolepunchAck. AddrOfHereAtServer=%s"},{"address":"0x14010b620","value":"Too long time elapsed since disconnecting mode! unsafeDisconnectReason=%d"},{"address":"0x14010b730","value":"Unexpected at CNetClientManager::Unregister"},{"address":"0x14010baf0","value":"Bad format in NotifyServerConnectSuccess"},{"address":"0x14010bc80","value":"Proud::CNetClientWorker::ProcessMessage_ProudNetLayer"},{"address":"0x14010c570","value":"GET %s HTTP/1.1\r\n\r\nHost: %s:%d\r\n\r\nConnection: Keep-Alive\r\n\r\n"},{"address":"0x14010c8c0","value":"Message_PeerUdp_ServerHolepunchAck. AddrOfHereAtServer=%s"},{"address":"0x14010cc20","value":"(first chance) to-peer client %d UDP punch lost##Reason:%d##CliInstCount=%d##RecentElapTime=%3.3f##DisconnedCount=%d##recv count=%d##last ok recv interval=%3.3f##Recurred:%d##LocalIP:%s##Remote peer behind NAT:%d##UDP kept time:%3.3f##Time diff since last RecvIssue:%3.3f##%s##Process=%s"},{"address":"0x14011af30","value":"option\\agent_serveroption.xml"},{"address":"0x14011af70","value":"Global\\RustyHearts_Agent"},{"address":"0x14011afa8","value":"AGENT"},{"address":"0x14011b000","value":"RetryConnectSession\n"},{"address":"0x14011b0f0","value":"** Server Load Time : %d sec\n"},{"address":"0x14011b110","value":"STEP : SERVER_RUN \n"},{"address":"0x14011b150","value":"%s : RETRY CONNECT : IP[ %s ] PORT[ %d ]\n"},{"address":"0x14011b1b0","value":"%s : RETRY CONNECT : ADDRESS[ %s ] PORT[ %d ]\n"},{"address":"0x14011b2e0","value":"Session [%d] S[ %d ] : ADDRESS[ %s ] PORT[ %d ] CODE[ %d ]\n"},{"address":"0x14011b360","value":"Session S[ %d ] : ADDRESS[ %s ] PORT[ %d ] CODE[ %d ]\n"},{"address":"0x14011b438","value":"Manager"},{"address":"0x14011b480","value":"Agent"},{"address":"0x14011b4d8","value":"Agentmanager"},{"address":"0x14011b588","value":"Server Version."},{"address":"0x14011b5b0","value":"All Server Kill."},{"address":"0x14011b5c8","value":"Server Information."},{"address":"0x14011b5e0","value":"All Server Down."},{"address":"0x14011b5f8","value":"Disconnect Server On."},{"address":"0x14011b610","value":"All Server On."},{"address":"0x14011b670","value":"Server Info."},{"address":"0x14011b680","value":"AgentManager Retry."},{"address":"0x14011b6b0","value":"Server Shutdown."},{"address":"0x14011b6e0","value":"Log\\Agent.log"},{"address":"0x14011b6f0","value":"Log\\Protocol_Agent"},{"address":"0x14011b718","value":"# Agent Startup #\n\n"},{"address":"0x14011b768","value":"\n # Agent Running... #\n"},{"address":"0x14011b798","value":"Start Auto Server On. \n"},{"address":"0x14011b7f0","value":"# Agent Stoped... #\n"},{"address":"0x14011b81e","value":"\n-AGENT SERVER [CODE:%d]---------------------------------\n"},{"address":"0x14011b950","value":"%d p2pConnectionPairCount\n"},{"address":"0x14011b970","value":"%d p2pDirectConnectionPairCount\n"},{"address":"0x14011b9b8","value":"All Server On. \n"},{"address":"0x14011b9d0","value":"Disconnect Server On. \n"},{"address":"0x14011ba60","value":"ConnectServer Count : [ %d ] \n"},{"address":"0x14011bb40","value":"ProcessID : %d\n"},{"address":"0x14011c928","value":"OnError MagiAgentNetwork : %s"},{"address":"0x14011c970","value":"OnWarning MagiAgentNetwork : %s"},{"address":"0x14011c9b0","value":"OnException MagiAgentNetwork : %s"},{"address":"0x14011c9d8","value":"NEW SERVER : HostID:[%d][%s] \n"},{"address":"0x14011ca20","value":"DELETE SERVER : HostID:[%d][%s] \n"},{"address":"0x14011ca98","value":"serveron"},{"address":"0x14011cc90","value":"OnError MGAgentManagerSession : %s"},{"address":"0x14011cce0","value":"OnWarning MGAgentManagerSession : %s"},{"address":"0x14011cd30","value":"OnException MGAgentManagerSession : %s"},{"address":"0x14011cd60","value":"AgentManager Connected : HostID[%d] \n"},{"address":"0x14011cdb0","value":"AgentManager Connect Failed %s \n"},{"address":"0x14011cdf8","value":"AgentManager Disconnected %s \n"},{"address":"0x14011ce38","value":"Exist AgentManager %s/%d \n"},{"address":"0x14011ce70","value":"AgentManaserSession->Process"},{"address":"0x14011cfd8","value":"NOT FIND PROCESS ID \n"},{"address":"0x14011d008","value":"FAILED SERVER ON %s "},{"address":"0x14011d038","value":"=======ServerOn=======\n"},{"address":"0x14011d068","value":"=======Server Fail=======\n"},{"address":"0x14011d130","value":"Process Kill.!!! [%s] \n"},{"address":"0x14011d248","value":"ERROR - NOT FIND SERVER : REQ_SERVER_OPTION !!!\n"},{"address":"0x14011d280","value":"Error - NOT EXIST SERVER : %d \n"},{"address":"0x14011d450","value":"PWE_REQ_NOTICE : CLIENT [ %d ] WORLD [ %d ] SERVER_TYPE [ %d ] NOTICE_TYPE [ %d ] NOTICE [ %s ] \n"},{"address":"0x14011d5d0","value":"ServerFile Count: %d !!! \n"},{"address":"0x14011d5f0","value":"ServerOption Count: %d !!! \n"},{"address":"0x14011d610","value":"AgentManager Count: %d !!! \n"},{"address":"0x14011d630","value":"REQ_SERVER_KILL"},{"address":"0x14011d758","value":"option\\service_control.xml"},{"address":"0x14011d7d0","value":"server_mode"},{"address":"0x14011d7e0","value":"billing_server_mode"},{"address":"0x14011d8a8","value":"auth_port"},{"address":"0x14011d9e8","value":"Active Service ServerMode : %s\n"},{"address":"0x14011da10","value":"Active Service BillingServerMode : %s\n"},{"address":"0x14011eb08","value":"PT_SERVER_STEP"},{"address":"0x14011eba0","value":"RESP_SERVER_LOCK"},{"address":"0x14011ebf8","value":"PT_SERVER_COMMAND_RESULT"},{"address":"0x14011ec30","value":"PT_SERVER_INFORMATION"},{"address":"0x14011ec60","value":"PT_SERVER_REGISTER"},{"address":"0x14011ee20","value":"PT_SERVER_CONNECT"},{"address":"0x14011ee48","value":"PT_SERVER_NOTICE"},{"address":"0x14011ee70","value":"PT_SERVER_COMMAND"},{"address":"0x14011ee98","value":"PT_SERVER_OPTIONS"},{"address":"0x14011f1d8","value":"PT_REFRESH_SERVER_OPTION"},{"address":"0x14011f210","value":"PT_REFRESH_SERVER_FILE"},{"address":"0x14011f240","value":"PT_AGENT_DATA"},{"address":"0x14011f260","value":"PT_PATCH_SERVER"},{"address":"0x14011f528","value":"option\\total_option.xml"},{"address":"0x14011f558","value":"option\\agent.xml"},{"address":"0x14011f570","value":"option\\patch.xml"},{"address":"0x14011f660","value":"agentmanager"},{"address":"0x14011f670","value":"server"},{"address":"0x14011f6c8","value":"start_server"},{"address":"0x14011f6d8","value":"revive_server"},{"address":"0x14011f780","value":"private_port"},{"address":"0x14011f7a0","value":"public_port"},{"address":"0x14011f7b0","value":"public_udpport"},{"address":"0x14011f7cc","value":"agent"},{"address":"0x14011f870","value":"msg_server"},{"address":"0x14011f880","value":"gm_server"},{"address":"0x14011f890","value":"auction_server"},{"address":"0x14011f8a0","value":"manager_server"},{"address":"0x14011f8b0","value":"match_server"},{"address":"0x14011f8c0","value":"agent_server"},{"address":"0x14011f940","value":"=================DNS. ServerParseOption============== \n"},{"address":"0x14011f9b0","value":"=================IP. ServerParseOption============== \n"},{"address":"0x14011fa20","value":"(PRIVATE)\t[ADDRESS:%s] [PORT:%d] \n"},{"address":"0x14011fa70","value":"(PUBLIC)\t[ADDRESS:%s] [PORT:%d] [UDP:%d] [UDPCOUNT:%d] \n"},{"address":"0x14011fbf0","value":"MANAGER"},{"address":"0x14011fc20","value":"AGENTMANAGER"},{"address":"0x14011fc50","value":"ServerNameByTypeAndCode ERROR - NOT TYPE : Type [ %d ] Code [ %d ]\n"},{"address":"0x14011fce0","value":"%s Error Agent Parse !!! \n"},{"address":"0x14011fd08","value":"connect"},{"address":"0x14011fd38","value":"Create Agent Option File Succeed \n"},{"address":"0x14011ffa0","value":"SERVER_FILE_INSERT : %d : %s \n"},{"address":"0x140120000","value":"Server Start : ADDRESS[%s] PORT[%d]"},{"address":"0x140120050","value":"PRIVATE NETWORK : ADDRESS[ %s ] PORT[ %d ]\n"},{"address":"0x1401200a8","value":"option\\customoption.xml"},{"address":"0x140120100","value":"agentmanagers"},{"address":"0x140120110","value":"serveroption"},{"address":"0x140120168","value":"manager"},{"address":"0x1401201f0","value":"LOGVIEWER Option [%d] - LogAgentManagers View.\n"},{"address":"0x140120220","value":"LOGVIEWER Option [%d] - LogAgent View.\n"},{"address":"0x140120298","value":"LOGVIEWER Option [%d] - LogServerOption View.\n"},{"address":"0x1401202f0","value":"Connect Option [%d] - DBC_GAME. \n"},{"address":"0x140120318","value":"Connect Option [%d] - DBC_LOG. \n"},{"address":"0x140120340","value":"Connect Option [%d] - Auction. \n"},{"address":"0x140120368","value":"Connect Option [%d] - Msg. \n"},{"address":"0x140120388","value":"Connect Option [%d] - Manager. \n"},{"address":"0x1401203b0","value":"Connect Option [%d] - Match. \n"},{"address":"0x1401203d0","value":"Connect Option [%d] - Gm. \n"},{"address":"0x1401203f0","value":"Connect Option [%d] - Gate. \n"},{"address":"0x140120410","value":"Connect Option [%d] - Lobby. \n"},{"address":"0x140120430","value":"Connect Option [%d] - Dungeon. \n"},{"address":"0x140120458","value":"Connect Option [%d] - Pvp. \n"},{"address":"0x140120478","value":"Connect Option [%d] - Guild. \n"},{"address":"0x140120498","value":"Connect Option [%d] - Agent. \n"},{"address":"0x1401204b8","value":"Connect Option [%d] - AgentManager. \n"},{"address":"0x140120500","value":"INSERT SERVER OPTION MODIFY - Code : [ %d ], Name [ %s ]\n"},{"address":"0x140120580","value":"INSERT SERVER OPTION - Code : [ %d ], Name [ %s ]\n"},{"address":"0x140120698","value":"Function not supported 40"},{"address":"0x140120920","value":"No more processes or not enough memory or maximum nesting level reached 11"},{"address":"0x140120970","value":"No spawned processes 10"},{"address":"0x1401209a0","value":"Exec format error\t8"},{"address":"0x140120a20","value":"No such process 3"},{"address":"0x1401527bc","value":"GetProcessHeaps"},{"address":"0x140152834","value":"GetCurrentProcessId"},{"address":"0x140152a04","value":"Process32NextW"},{"address":"0x140152a16","value":"Process32FirstW"},{"address":"0x140152a44","value":"GetProcessHeap"},{"address":"0x140152b50","value":"GetCurrentProcess"},{"address":"0x1401536e4","value":"_configthreadlocale"},{"address":"0x1401537d0","value":"BT_SetSupportEMail"},{"address":"0x1401537f4","value":"BT_SetSupportServer"},{"address":"0x14015380a","value":"BT_SetSupportURL"},{"address":"0x140153846","value":"BT_SetReportFilePath"},{"address":"0x140153870","value":"GetExitCodeProcess"},{"address":"0x140153886","value":"CreateProcessW"},{"address":"0x140153898","value":"OpenProcess"},{"address":"0x1401538a6","value":"TerminateProcess"},{"address":"0x14015416c","value":"Agent_Release_x64.exe"},{"address":"0x1401552b8","value":".?AUAddrPort@Proud@@"},{"address":"0x140155310","value":".?AVCReportSocketDg@Proud@@"},{"address":"0x140155a68","value":".?AVICompletionPortEventSink@Proud@@"},{"address":"0x140155af8","value":".?AVIVizAgentDg@Proud@@"},{"address":"0x140155b48","value":".?AVProxy@CNetServerImpl@Proud@@"},{"address":"0x140155ba8","value":".?AVCNetServer@Proud@@"},{"address":"0x140155bd0","value":".?AVC2SStub@CNetServerImpl@Proud@@"},{"address":"0x140155dd0","value":".?AV?$CFastArray@UConnectionInfo@CNetServerImpl@Proud@@$0A@@Proud@@"},{"address":"0x140155e60","value":".?AV?$CFastArray@PEAVP2PConnectionState@Proud@@$0A@@Proud@@"},{"address":"0x140155ff0","value":".?AVCNetServerImpl@Proud@@"},{"address":"0x140156250","value":".?AVIUdpPacketFragBoardDg@Proud@@"},{"address":"0x140156288","value":".?AVIUdpPacketDefragBoardDg@Proud@@"},{"address":"0x1401562c0","value":".?AVStateBase@CP2PConnectionTrialContext@Proud@@"},{"address":"0x140156420","value":".?AVPeerHolepunchState@CP2PConnectionTrialContext@Proud@@"},{"address":"0x1401564a0","value":".?AVServerAsSendDest@CNetClientImpl@Proud@@"},{"address":"0x140156b58","value":".?AVCVizAgent@Proud@@"},{"address":"0x140156ca0","value":".?AV?$CFastArray@PEAVUdpPacketCtx@Proud@@$00@Proud@@"},{"address":"0x140156f18","value":".?AVCNetClientManager@Proud@@"},{"address":"0x140156f50","value":".?AV?$CSafeSingleton@VCNetClientManager@Proud@@@Proud@@"},{"address":"0x140157170","value":".?AVServerHolepunchState@CP2PConnectionTrialContext@Proud@@"},{"address":"0x140157470","value":".?AVMagiServerBase@@"},{"address":"0x140157520","value":".?AV?$MBISingleton@VMagiAgentServer@@@@"},{"address":"0x140157558","value":".?AVMagiAgentServer@@"},{"address":"0x14015b1a0","value":".?AVStub@SERVER2AGENT_PROTOCOL@@"},{"address":"0x14015b1d8","value":".?AVServer2AgentStub@RNP@@"},{"address":"0x14015b208","value":".?AVINetServerEvent@Proud@@"},{"address":"0x14015b238","value":".?AVMagiBaseServerNetwork@@"},{"address":"0x14015b268","value":".?AVMagiAgentNetwork@@"},{"address":"0x14015b290","value":".?AVStub@AGENTMANAGER2AGENT_PROTOCOL@@"},{"address":"0x14015b2c8","value":".?AVAgentManager2AgentStub@RNP@@"},{"address":"0x14015b300","value":".?AVMGAgentManagerSession@@"},{"address":"0x14015b330","value":".?AV?$MBISingleton@VMagiAgentProcess@@@@"},{"address":"0x14015b370","value":".?AVMagiAgentProcess@@"},{"address":"0x14015b880","value":".?AVIObserver@@"},{"address":"0x14015b8a0","value":".?AVAgent2ServerProxy@RNP@@"},{"address":"0x14015b8f8","value":".?AVProxy@AGENT2SERVER_PROTOCOL@@"},{"address":"0x14015b958","value":".?AVAgent2AgentManagerProxy@RNP@@"},{"address":"0x14015b990","value":".?AVProxy@AGENT2AGENTMANAGER_PROTOCOL@@"},{"address":"0x14015b9c8","value":".?AV?$MBISingleton@VMagiServerOption@@@@"},{"address":"0x14015ba08","value":".?AVMagiServerOption@@"},{"address":"0x14015bc28","value":".?AV?$MBISingleton@VMagiServerFile@@@@"},{"address":"0x14015bc60","value":".?AVMagiServerFile@@"},{"address":"0x14015bd20","value":".?AV?$MBISingleton@VMagiServerManager@@@@"},{"address":"0x14015bd60","value":".?AVMagiServerManager@@"},{"address":"0x14015bd88","value":".?AV?$MBISingleton@VMagiAgentCommon@@@@"},{"address":"0x14015bdc0","value":".?AVMagiAgentCommon@@"}],"operation":"search_strings","parameters":{"case_sensitive":false,"mode":"regex","pattern":"(?i)agent|manager|\\.ini|\\.xml|config|process|server|port|connect|listen|packet|exe"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":[{"address":"0x1400f3358","value":"GetLogicalProcessorInformation"},{"address":"0x1400f3488","value":"CreateIoCompletionPort"},{"address":"0x1400f3ea0","value":" HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.3.154.9 Safari/525.19\r\nAccept-Language: ko-KR,ko,en-US,en\r\nAccept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\nCache-Control: max-age=0\r\nAccept-Charset: EUC-KR,*,utf-8\r\nAccept-Encoding: gzip,deflate,bzip2\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n"},{"address":"0x1400f4048","value":"GET /PNReport/ReportError.php?Text="},{"address":"0x1400f4258","value":"**ErrorReport** "},{"address":"0x1400f4370","value":"ErrReporter"},{"address":"0x1400f4928","value":"Proud::CFastSocket::Connect"},{"address":"0x1400f4b70","value":"Proud::CFastSocket::Listen"},{"address":"0x1400f4d60","value":"This socket doesn't support TTL change!"},{"address":"0x1400f4db0","value":"Sending to prohibited port is not permitted!"},{"address":"0x1400f55f0","value":"CListNode reports a consistency problem at %s !"},{"address":"0x1400f5800","value":"Proud::CompletionPort::AssociateSocket"},{"address":"0x1400f6630","value":"Too large message is detected. Contact technical supports."},{"address":"0x1400f66b0","value":"Invalid packet format. Remote host is hacked or has a bug."},{"address":"0x1400f67a0","value":"Client-server UDP comm is blocked."},{"address":"0x1400f6aa0","value":"Server socket listen failure. Make sure that the TCP or UDP listening port is not already in use."},{"address":"0x1400f6b68","value":"Server is not ready."},{"address":"0x1400f6c18","value":"Local host disconnected."},{"address":"0x1400f6c50","value":"Remote host disconnected."},{"address":"0x1400f6c90","value":"Connecting to server successful."},{"address":"0x1400f6ce0","value":"Server denied connection attempt."},{"address":"0x1400f6d78","value":"Connect to server timed out."},{"address":"0x1400f6e68","value":"TCP connection failure."},{"address":"0x1400f6e98","value":"Already connected."},{"address":"0x1400f7680","value":"Not supported value yet!"},{"address":"0x1400f7ab0","value":"Proud::CNetServerImpl::GetP2PGroupCount"},{"address":"0x1400f7e40","value":"Proud::CNetServerImpl::GetClientCount"},{"address":"0x1400f7ec0","value":"Proud::CNetServerImpl::SetDefaultTimeoutTimeSec"},{"address":"0x1400f7f20","value":"Too long timeout value. It may take a lot of time to detect lost connection."},{"address":"0x1400f7fc0","value":"Too short timeout value. It may cause unfair disconnection."},{"address":"0x1400f8070","value":"Proud::CNetServerImpl::SetDirectP2PStartCondition"},{"address":"0x1400f8140","value":"Cannot set AllowEmptyP2PGroup after the server has started."},{"address":"0x1400f81c0","value":"Proud::CNetServerImpl::AllowEmptyP2PGroup"},{"address":"0x1400f8280","value":"Proud::CNetServerImpl::SetHostTag"},{"address":"0x1400f8500","value":"Proud::CNetServerImpl::GetJoinedP2PGroups"},{"address":"0x1400f8590","value":"Proud::CNetServerImpl::CloseEveryConnection"},{"address":"0x1400f8620","value":"Proud::CNetServerImpl::GetLastPingSec"},{"address":"0x1400f86a0","value":"Proud::CNetServerImpl::GetRecentPingSec"},{"address":"0x1400f8720","value":"Proud::CNetServerImpl::GetClientHostIDs"},{"address":"0x1400f87a0","value":"Proud::CNetServerImpl::GetClientInfo"},{"address":"0x1400f8820","value":"Proud::CNetServerImpl::TcpAndUdp_DoForLongInterval"},{"address":"0x1400f88f0","value":"Proud::CNetServerImpl::EnableLog"},{"address":"0x1400f8970","value":"Proud::CNetServerImpl::DisableLog"},{"address":"0x1400f89f0","value":"Proud::CNetServerImpl::GetStats"},{"address":"0x1400f8a60","value":"Cannot call GetUdpListenerLocalAddrs unless ServerUdpAssignMode_Static is used!"},{"address":"0x1400f8b00","value":"Proud::CNetServerImpl::GetUdpListenerLocalAddrs"},{"address":"0x1400f8b90","value":"Proud::CNetServerImpl::NextEncryptCount"},{"address":"0x1400f8c10","value":"Proud::CNetServerImpl::PrevEncryptCount"},{"address":"0x1400f8c90","value":"Proud::CNetServerImpl::GetExpectedDecryptCount"},{"address":"0x1400f8d20","value":"Proud::CNetServerImpl::NextDecryptCount"},{"address":"0x1400f8da0","value":"Proud::CNetServerImpl::IsConnectedClient"},{"address":"0x1400f8e30","value":"Proud::CNetServerImpl::EnableSpeedHackDetector"},{"address":"0x1400f8ec0","value":"Proud::CNetServerImpl::SetMaxDirectP2PConnectionCount"},{"address":"0x1400f8f90","value":"Cannot call GetUdpSocketAddrList unless ServerUdpAssignMode_Static is used!"},{"address":"0x1400f9030","value":"Proud::CNetServerImpl::GetUdpSocketAddrList"},{"address":"0x1400f9090","value":"Proud::CNetServerImpl::GetTaskSubjectByHostID_NOLOCK"},{"address":"0x1400f9940","value":"Proud::CNetServerImpl::C2SStub::NotifyNatDeviceNameDetected"},{"address":"0x1400f99f0","value":"Proud::CNetServerImpl::C2SStub::NotifySendSpeed"},{"address":"0x1400f9aa0","value":"Proud::CNetServerImpl::C2SStub::NotifyLog"},{"address":"0x1400f9bd0","value":"Proud::CNetServerImpl::C2SStub::NotifyLogHolepunchFreqFail"},{"address":"0x1400f9c80","value":"Proud::CNetServerImpl::C2SStub::ReliablePing"},{"address":"0x1400f9d10","value":"Proud::CNetServerImpl::C2SStub::ShutdownTcp"},{"address":"0x1400f9da0","value":"Proud::CNetServerImpl::C2SStub::NotifyNatDeviceName"},{"address":"0x1400f9e40","value":"Proud::CNetServerImpl::C2SStub::ReportP2PPeerPing"},{"address":"0x1400f9ee0","value":"Proud::CNetServerImpl::C2SStub::ReportC2CUdpMessageCount"},{"address":"0x1400f9f90","value":"Proud::CNetServerImpl::C2SStub::ReportC2SUdpMessageTrialCount"},{"address":"0x1400fa040","value":"Proud::CNetServerImpl::PurgeTooOldUnmatureClient"},{"address":"0x1400fa0e0","value":"%d remote rc is %s in netserver!"},{"address":"0x1400fa170","value":"Proud::CNetServerImpl::GetCryptSessionKey"},{"address":"0x1400fa260","value":"Proud::CNetServerImpl::CloseConnection"},{"address":"0x1400fa2e0","value":"Proud::CNetServerImpl::GetP2PRecentPing"},{"address":"0x1400fa370","value":"Proud::CNetServerImpl::GetP2PConnectionStats"},{"address":"0x1400fa490","value":"Proud::CNetServerImpl::ElectSuperPeer"},{"address":"0x1400fa570","value":"Proud::CNetServerImpl::GetUserWorkerThreadInfo"},{"address":"0x1400fa600","value":"Proud::CNetServerImpl::GetNetWorkerThreadInfo"},{"address":"0x1400fa6c0","value":"NetServer udpIssueQueueCS DeadLock!! - %s"},{"address":"0x1400fa720","value":"NetServer tcpIssueQueueCS DeadLock!! - %s"},{"address":"0x1400faa00","value":"Proud::CNetServerImpl::C2SStub::C2S_CreateUdpSocketAck"},{"address":"0x1400fac00","value":"Proud::CNetServerImpl::C2SStub::NotifyUdpToTcpFallbackByClient"},{"address":"0x1400fae20","value":"Proud::CNetServerImpl::C2SStub::NotifyP2PHolepunchSuccess"},{"address":"0x1400faf20","value":"Proud::CNetServerImpl::C2SStub::P2P_NotifyDirectP2PDisconnected"},{"address":"0x1400fb070","value":"Proud::CNetServerImpl::C2SStub::NotifyPeerUdpSocketRestored"},{"address":"0x1400fb1c0","value":"Proud::CNetServerImpl::EnquePacketDefragWarning"},{"address":"0x1400fb480","value":"Proud::CNetServerImpl::CreateAndInitUdpSockets"},{"address":"0x1400fb570","value":"All UDP port numbers specified at Server Start are deleted! An arbitary port number is assigned instead."},{"address":"0x1400fb870","value":"Proud::CNetServerImpl::C2SStub::NotifyJitDirectP2PTriggered"},{"address":"0x1400fb920","value":"Proud::CNetServerImpl::C2SStub::C2S_RequestCreateUdpSocket"},{"address":"0x1400fb9d0","value":"CStartServerParameter::m_fastEncryptedMessageKeyLength Incorrect key lengt, MaxSize is 2048, MinSize is 8"},{"address":"0x1400fba40","value":"CStartServerParameter::m_encryptedMessageKeyLength Incorrect key length, only 128,192,256"},{"address":"0x1400fbaa0","value":"No NIC binding though multiple NIC detected##Process=%s"},{"address":"0x1400fbb10","value":"Server has multiple network devices, however, no device is specified for listening. Is it your intention?"},{"address":"0x1400fbbf0","value":"Cannot add duplicated UDP port number!"},{"address":"0x1400fbc70","value":"Cannot assign non-zero UDP port number with zero UDP port number! All non-zero or all zero must be guaranteed!"},{"address":"0x1400fbff0","value":"Proud::CNetServerImpl::GetP2PGroupInfo"},{"address":"0x1400fc0a0","value":"Proud::CNetServerImpl::GetMostSuitableSuperPeerInGroup"},{"address":"0x1400fc110","value":"Proud::CNetServerImpl::IsValidHostID_NOLOCK"},{"address":"0x1400fc1a0","value":"Proud::CNetServerImpl::GetSuitableSuperPeerRankListInGroup"},{"address":"0x1400fc420","value":"Proud::CNetServerImpl::ProcessOneLocalEvent"},{"address":"0x1400fc5e0","value":"Proud::CNetServerImpl::Send_BroadcastLayer"},{"address":"0x1400fcba0","value":"Proud::CNetServerImpl::C2SStub::P2PGroup_MemberJoin_Ack"},{"address":"0x1400fcc40","value":"Proud::CNetServerImpl::GetP2PGroups"},{"address":"0x1400fccc0","value":"Proud::CNetServerImpl::PurgeTooOldAddMemberAckItem"},{"address":"0x1400fce50","value":"Proud::CNetServerImpl::JoinP2PGroup"},{"address":"0x1400fced0","value":"Proud::CNetServerImpl::EnqueueHackSuspectEvent"},{"address":"0x1400fcf60","value":"Proud::CNetServerImpl::EnqueueP2PGroupRemoveEvent"},{"address":"0x1400fd000","value":"Proud::CNetServerImpl::EnqueueUnitTestFailEvent"},{"address":"0x1400fd1c8","value":"AddrPort.IsSameLan fail!"},{"address":"0x1400fd250","value":"Proud::CNetServerImpl::EnqueError"},{"address":"0x1400fd2d0","value":"Proud::CNetServerImpl::EnqueWarning"},{"address":"0x1400fd380","value":"Proud::CNetServerImpl::DestroyP2PGroup"},{"address":"0x1400fd400","value":"Proud::CNetServerImpl::LeaveP2PGroup"},{"address":"0x1400fd4d0","value":"Proud::CNetServerImpl::CreateP2PGroup"},{"address":"0x1400fd600","value":"Proud::CNetServerImpl::DestroyEmptyP2PGroups"},{"address":"0x1400fd710","value":"Proud::CNetServerImpl::TestReliableUdpFrame"},{"address":"0x1400fd7a0","value":"Proud::CNetServerImpl::HardDisconnect_AutoPruneGoesTooLongClient"},{"address":"0x1400fd860","value":"Proud::CNetServerImpl::C2SStub::ShutdownTcpHandshake"},{"address":"0x1400fd928","value":"Proud::CNetServerImpl::Stop"},{"address":"0x1400fd990","value":"Proud::CNetServerImpl::DisposeIssuedRemoteClients"},{"address":"0x1400fda30","value":"Proud::CNetServerImpl::~CNetServerImpl"},{"address":"0x1400fdab0","value":"Proud::CNetServerImpl::HeartBeat_PerClient"},{"address":"0x1400fdb40","value":"Cannot send messages unless connection to server exists!"},{"address":"0x1400ffc00","value":"Received stream from TCP server became inconsistent!"},{"address":"0x1400ffc98","value":"Sending ServerHolepunch: %s"},{"address":"0x140100320","value":"Unstability in Connect #1! Process=%s"},{"address":"0x140100370","value":"Unstability in Connect #3! Process=%s"},{"address":"0x1401003c0","value":"Wrong state(%s)! Disconnect() or GetServerConnectionState() may be required."},{"address":"0x140100c80","value":"Unstability in Disconnect #1! Process=%s"},{"address":"0x140100ce0","value":"Unstability in Disconnect #2! Process=%s"},{"address":"0x140100d40","value":"CNetClient.Disconnect seems to be freezed ## State=%d##GarbageCount=%d##Process=%s"},{"address":"0x140100ec0","value":"(first chance) to-server UDP punch lost##Reason:%d##CliInstCount=%d##RecentElapTime=%3.3f##DisconnedCount=%d##recv count=%d##last ok recv interval=%3.3f##Recurred:%d##LocalIP:%s##UDP kept time:%3.3f##Time diff since RecvIssue:%3.3f##NAT name=%s##%s##Process=%s"},{"address":"0x1401016d0","value":"RMI Proxy which is still in use by ProudNet core cannot be destroyed! Destroy CNetClient or CNetServer instance first."},{"address":"0x140101840","value":"Already async callback may occur! server start or client connection should have not been done before here!"},{"address":"0x140101c90","value":"CStartServerParameter.m_enableP2PEncryptedMessaging=false. P2P Messaging can not encrypted!!"},{"address":"0x140101ee0","value":"Proud::CNetCoreImpl::ProcessMessage_Encrypted"},{"address":"0x140101f70","value":"Packet compression failed! Error code=%d"},{"address":"0x140102030","value":"RMI Stub which is still in use by ProudNet core cannot be destroyed! Destroy CNetClient or CNetServer instance first."},{"address":"0x1401022f0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_SpeedHackDetectorPing"},{"address":"0x1401023b0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ReplyReceiveSpeedAtReceiverSide_NoBypass"},{"address":"0x1401027b4","value":": Client local Addr=%s,Client addr at server=%s"},{"address":"0x140102820","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_NotifyHolepunchSuccess"},{"address":"0x1401029a0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_PeerUdp_NotifyHolepunchSuccess"},{"address":"0x140102a70","value":"MessageType_ServerHolepunch from %s"},{"address":"0x140102ac0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ServerHolepunch"},{"address":"0x140102b80","value":"MessageType_PeerUdp_ServerHolepunch from %s"},{"address":"0x140102be0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_PeerUdp_ServerHolepunch"},{"address":"0x140102cc0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ReliableRelay1"},{"address":"0x140102db0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_UnreliableRelay1"},{"address":"0x140102e40","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_UnreliableRelay1"},{"address":"0x140102eb0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_LingerDataFrame1"},{"address":"0x140102f40","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_LingerDataFrame1"},{"address":"0x140102ff0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_RequestServerTimeAndKeepAlive"},{"address":"0x1401030f0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_RequestReceiveSpeedAtReceiverSide_NoBypass"},{"address":"0x1401031f0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_NotifyServerConnectionRequestData"},{"address":"0x1401034b0","value":"Proud::CNetThreads_S::TcpListenerProc_DoAcceptedSocket"},{"address":"0x1401037d0","value":"Proud::CNetThreads_S::NetworkerThread_ProcessMessage_NotifyCSEncryptedSessionKey"},{"address":"0x140103a00","value":"Proud::CNetThreads_S::TcpListenerProc"},{"address":"0x140103b18","value":"PNSrv TcpListener"},{"address":"0x140103ba0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_Rmi"},{"address":"0x140103c40","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_UserMessage"},{"address":"0x140103cf0","value":"Proud::CNetThreads_S::NetWorkerThread_ProcessMessage_ProudNetLayer"},{"address":"0x140104410","value":"ServerSocketPool is already destructed!"},{"address":"0x140108308","value":"NotifyCli_ConnectionState"},{"address":"0x140109510","value":"Proud::CListNode::CListOwner::Erase"},{"address":"0x140109590","value":"Proud::CListNode::CListOwner::Erase"},{"address":"0x1401096b0","value":"Unexpected at PacketQueue Pop!"},{"address":"0x140109840","value":"Unexpected state in RemoteToPacketSendMap #2!"},{"address":"0x1401098a0","value":"Unexpected state in RemoteToPacketSendMap!"},{"address":"0x140109a60","value":"PacketQueue consistency failed!"},{"address":"0x140109aa0","value":"PacketQueue consistency 2 failed!"},{"address":"0x140109b10","value":"UDP frag length is wrong #1! packetlength=%d, maxlength=%d, fragID=%d"},{"address":"0x140109c20","value":"UDP frag length is wrong #3! assembledDataCount=%d, packetLength=%d"},{"address":"0x140109d40","value":"UDP full packet length is wrong!"},{"address":"0x140109d90","value":"Cannot identify UDP fragment nor full packet! fragheaderSplitter=%u"},{"address":"0x14010a260","value":"Disconnected"},{"address":"0x14010a280","value":"Connecting"},{"address":"0x14010a298","value":"Connected"},{"address":"0x14010a2b0","value":"Disconnecting"},{"address":"0x14010a2d0","value":""},{"address":"0x14010a890","value":"FastEncrypt Key Length is 0, Check ServerStartParameters m_fastEncryptedMessageKeyLength"},{"address":"0x14010abc8","value":"PUBLIC KEY EXPORT ERROR"},{"address":"0x14010adc8","value":"Incorrect Packet"},{"address":"0x14010b300","value":"CNetClientManager.dtor assert fail: %d %d"},{"address":"0x14010b4f0","value":"Message_ServerHolepunchAck. AddrOfHereAtServer=%s"},{"address":"0x14010b620","value":"Too long time elapsed since disconnecting mode! unsafeDisconnectReason=%d"},{"address":"0x14010b730","value":"Unexpected at CNetClientManager::Unregister"},{"address":"0x14010baf0","value":"Bad format in NotifyServerConnectSuccess"},{"address":"0x14010bc80","value":"Proud::CNetClientWorker::ProcessMessage_ProudNetLayer"},{"address":"0x14010c570","value":"GET %s HTTP/1.1\r\n\r\nHost: %s:%d\r\n\r\nConnection: Keep-Alive\r\n\r\n"},{"address":"0x14010c8c0","value":"Message_PeerUdp_ServerHolepunchAck. AddrOfHereAtServer=%s"},{"address":"0x14010cc20","value":"(first chance) to-peer client %d UDP punch lost##Reason:%d##CliInstCount=%d##RecentElapTime=%3.3f##DisconnedCount=%d##recv count=%d##last ok recv interval=%3.3f##Recurred:%d##LocalIP:%s##Remote peer behind NAT:%d##UDP kept time:%3.3f##Time diff since last RecvIssue:%3.3f##%s##Process=%s"},{"address":"0x14011af30","value":"option\\agent_serveroption.xml"},{"address":"0x14011af70","value":"Global\\RustyHearts_Agent"},{"address":"0x14011afa8","value":"AGENT"},{"address":"0x14011b000","value":"RetryConnectSession\n"},{"address":"0x14011b0f0","value":"** Server Load Time : %d sec\n"},{"address":"0x14011b110","value":"STEP : SERVER_RUN \n"},{"address":"0x14011b150","value":"%s : RETRY CONNECT : IP[ %s ] PORT[ %d ]\n"},{"address":"0x14011b1b0","value":"%s : RETRY CONNECT : ADDRESS[ %s ] PORT[ %d ]\n"},{"address":"0x14011b2e0","value":"Session [%d] S[ %d ] : ADDRESS[ %s ] PORT[ %d ] CODE[ %d ]\n"},{"address":"0x14011b360","value":"Session S[ %d ] : ADDRESS[ %s ] PORT[ %d ] CODE[ %d ]\n"},{"address":"0x14011b438","value":"Manager"},{"address":"0x14011b480","value":"Agent"},{"address":"0x14011b4d8","value":"Agentmanager"},{"address":"0x14011b588","value":"Server Version."},{"address":"0x14011b5b0","value":"All Server Kill."},{"address":"0x14011b5c8","value":"Server Information."},{"address":"0x14011b5e0","value":"All Server Down."},{"address":"0x14011b5f8","value":"Disconnect Server On."},{"address":"0x14011b610","value":"All Server On."},{"address":"0x14011b670","value":"Server Info."},{"address":"0x14011b680","value":"AgentManager Retry."},{"address":"0x14011b6b0","value":"Server Shutdown."},{"address":"0x14011b6e0","value":"Log\\Agent.log"},{"address":"0x14011b6f0","value":"Log\\Protocol_Agent"},{"address":"0x14011b718","value":"# Agent Startup #\n\n"},{"address":"0x14011b768","value":"\n # Agent Running... #\n"},{"address":"0x14011b798","value":"Start Auto Server On. \n"},{"address":"0x14011b7f0","value":"# Agent Stoped... #\n"},{"address":"0x14011b81e","value":"\n-AGENT SERVER [CODE:%d]---------------------------------\n"},{"address":"0x14011b950","value":"%d p2pConnectionPairCount\n"},{"address":"0x14011b970","value":"%d p2pDirectConnectionPairCount\n"},{"address":"0x14011b9b8","value":"All Server On. \n"},{"address":"0x14011b9d0","value":"Disconnect Server On. \n"},{"address":"0x14011ba60","value":"ConnectServer Count : [ %d ] \n"},{"address":"0x14011bb40","value":"ProcessID : %d\n"},{"address":"0x14011c928","value":"OnError MagiAgentNetwork : %s"},{"address":"0x14011c970","value":"OnWarning MagiAgentNetwork : %s"},{"address":"0x14011c9b0","value":"OnException MagiAgentNetwork : %s"},{"address":"0x14011c9d8","value":"NEW SERVER : HostID:[%d][%s] \n"},{"address":"0x14011ca20","value":"DELETE SERVER : HostID:[%d][%s] \n"},{"address":"0x14011ca98","value":"serveron"},{"address":"0x14011cc90","value":"OnError MGAgentManagerSession : %s"},{"address":"0x14011cce0","value":"OnWarning MGAgentManagerSession : %s"},{"address":"0x14011cd30","value":"OnException MGAgentManagerSession : %s"},{"address":"0x14011cd60","value":"AgentManager Connected : HostID[%d] \n"},{"address":"0x14011cdb0","value":"AgentManager Connect Failed %s \n"},{"address":"0x14011cdf8","value":"AgentManager Disconnected %s \n"},{"address":"0x14011ce38","value":"Exist AgentManager %s/%d \n"},{"address":"0x14011ce70","value":"AgentManaserSession->Process"},{"address":"0x14011cfd8","value":"NOT FIND PROCESS ID \n"},{"address":"0x14011d008","value":"FAILED SERVER ON %s "},{"address":"0x14011d038","value":"=======ServerOn=======\n"},{"address":"0x14011d068","value":"=======Server Fail=======\n"},{"address":"0x14011d130","value":"Process Kill.!!! [%s] \n"},{"address":"0x14011d248","value":"ERROR - NOT FIND SERVER : REQ_SERVER_OPTION !!!\n"},{"address":"0x14011d280","value":"Error - NOT EXIST SERVER : %d \n"},{"address":"0x14011d450","value":"PWE_REQ_NOTICE : CLIENT [ %d ] WORLD [ %d ] SERVER_TYPE [ %d ] NOTICE_TYPE [ %d ] NOTICE [ %s ] \n"},{"address":"0x14011d5d0","value":"ServerFile Count: %d !!! \n"},{"address":"0x14011d5f0","value":"ServerOption Count: %d !!! \n"},{"address":"0x14011d610","value":"AgentManager Count: %d !!! \n"},{"address":"0x14011d630","value":"REQ_SERVER_KILL"},{"address":"0x14011d758","value":"option\\service_control.xml"},{"address":"0x14011d7d0","value":"server_mode"},{"address":"0x14011d7e0","value":"billing_server_mode"},{"address":"0x14011d8a8","value":"auth_port"},{"address":"0x14011d9e8","value":"Active Service ServerMode : %s\n"},{"address":"0x14011da10","value":"Active Service BillingServerMode : %s\n"},{"address":"0x14011eb08","value":"PT_SERVER_STEP"},{"address":"0x14011eba0","value":"RESP_SERVER_LOCK"},{"address":"0x14011ebf8","value":"PT_SERVER_COMMAND_RESULT"},{"address":"0x14011ec30","value":"PT_SERVER_INFORMATION"},{"address":"0x14011ec60","value":"PT_SERVER_REGISTER"},{"address":"0x14011ee20","value":"PT_SERVER_CONNECT"},{"address":"0x14011ee48","value":"PT_SERVER_NOTICE"},{"address":"0x14011ee70","value":"PT_SERVER_COMMAND"},{"address":"0x14011ee98","value":"PT_SERVER_OPTIONS"},{"address":"0x14011f1d8","value":"PT_REFRESH_SERVER_OPTION"},{"address":"0x14011f210","value":"PT_REFRESH_SERVER_FILE"},{"address":"0x14011f240","value":"PT_AGENT_DATA"},{"address":"0x14011f260","value":"PT_PATCH_SERVER"},{"address":"0x14011f528","value":"option\\total_option.xml"},{"address":"0x14011f558","value":"option\\agent.xml"},{"address":"0x14011f570","value":"option\\patch.xml"},{"address":"0x14011f660","value":"agentmanager"},{"address":"0x14011f670","value":"server"},{"address":"0x14011f6c8","value":"start_server"},{"address":"0x14011f6d8","value":"revive_server"},{"address":"0x14011f780","value":"private_port"},{"address":"0x14011f7a0","value":"public_port"},{"address":"0x14011f7b0","value":"public_udpport"},{"address":"0x14011f7cc","value":"agent"},{"address":"0x14011f870","value":"msg_server"},{"address":"0x14011f880","value":"gm_server"},{"address":"0x14011f890","value":"auction_server"},{"address":"0x14011f8a0","value":"manager_server"},{"address":"0x14011f8b0","value":"match_server"},{"address":"0x14011f8c0","value":"agent_server"},{"address":"0x14011f940","value":"=================DNS. ServerParseOption============== \n"},{"address":"0x14011f9b0","value":"=================IP. ServerParseOption============== \n"},{"address":"0x14011fa20","value":"(PRIVATE)\t[ADDRESS:%s] [PORT:%d] \n"},{"address":"0x14011fa70","value":"(PUBLIC)\t[ADDRESS:%s] [PORT:%d] [UDP:%d] [UDPCOUNT:%d] \n"},{"address":"0x14011fbf0","value":"MANAGER"},{"address":"0x14011fc20","value":"AGENTMANAGER"},{"address":"0x14011fc50","value":"ServerNameByTypeAndCode ERROR - NOT TYPE : Type [ %d ] Code [ %d ]\n"},{"address":"0x14011fce0","value":"%s Error Agent Parse !!! \n"},{"address":"0x14011fd08","value":"connect"},{"address":"0x14011fd38","value":"Create Agent Option File Succeed \n"},{"address":"0x14011ffa0","value":"SERVER_FILE_INSERT : %d : %s \n"},{"address":"0x140120000","value":"Server Start : ADDRESS[%s] PORT[%d]"},{"address":"0x140120050","value":"PRIVATE NETWORK : ADDRESS[ %s ] PORT[ %d ]\n"},{"address":"0x1401200a8","value":"option\\customoption.xml"},{"address":"0x140120100","value":"agentmanagers"},{"address":"0x140120110","value":"serveroption"},{"address":"0x140120168","value":"manager"},{"address":"0x1401201f0","value":"LOGVIEWER Option [%d] - LogAgentManagers View.\n"},{"address":"0x140120220","value":"LOGVIEWER Option [%d] - LogAgent View.\n"},{"address":"0x140120298","value":"LOGVIEWER Option [%d] - LogServerOption View.\n"},{"address":"0x1401202f0","value":"Connect Option [%d] - DBC_GAME. \n"},{"address":"0x140120318","value":"Connect Option [%d] - DBC_LOG. \n"},{"address":"0x140120340","value":"Connect Option [%d] - Auction. \n"},{"address":"0x140120368","value":"Connect Option [%d] - Msg. \n"},{"address":"0x140120388","value":"Connect Option [%d] - Manager. \n"},{"address":"0x1401203b0","value":"Connect Option [%d] - Match. \n"},{"address":"0x1401203d0","value":"Connect Option [%d] - Gm. \n"},{"address":"0x1401203f0","value":"Connect Option [%d] - Gate. \n"},{"address":"0x140120410","value":"Connect Option [%d] - Lobby. \n"},{"address":"0x140120430","value":"Connect Option [%d] - Dungeon. \n"},{"address":"0x140120458","value":"Connect Option [%d] - Pvp. \n"},{"address":"0x140120478","value":"Connect Option [%d] - Guild. \n"},{"address":"0x140120498","value":"Connect Option [%d] - Agent. \n"},{"address":"0x1401204b8","value":"Connect Option [%d] - AgentManager. \n"},{"address":"0x140120500","value":"INSERT SERVER OPTION MODIFY - Code : [ %d ], Name [ %s ]\n"},{"address":"0x140120580","value":"INSERT SERVER OPTION - Code : [ %d ], Name [ %s ]\n"},{"address":"0x140120698","value":"Function not supported 40"},{"address":"0x140120920","value":"No more processes or not enough memory or maximum nesting level reached 11"},{"address":"0x140120970","value":"No spawned processes 10"},{"address":"0x1401209a0","value":"Exec format error\t8"},{"address":"0x140120a20","value":"No such process 3"},{"address":"0x1401527bc","value":"GetProcessHeaps"},{"address":"0x140152834","value":"GetCurrentProcessId"},{"address":"0x140152a04","value":"Process32NextW"},{"address":"0x140152a16","value":"Process32FirstW"},{"address":"0x140152a44","value":"GetProcessHeap"},{"address":"0x140152b50","value":"GetCurrentProcess"},{"address":"0x1401536e4","value":"_configthreadlocale"},{"address":"0x1401537d0","value":"BT_SetSupportEMail"},{"address":"0x1401537f4","value":"BT_SetSupportServer"},{"address":"0x14015380a","value":"BT_SetSupportURL"},{"address":"0x140153846","value":"BT_SetReportFilePath"},{"address":"0x140153870","value":"GetExitCodeProcess"},{"address":"0x140153886","value":"CreateProcessW"},{"address":"0x140153898","value":"OpenProcess"},{"address":"0x1401538a6","value":"TerminateProcess"},{"address":"0x14015416c","value":"Agent_Release_x64.exe"},{"address":"0x1401552b8","value":".?AUAddrPort@Proud@@"},{"address":"0x140155310","value":".?AVCReportSocketDg@Proud@@"},{"address":"0x140155a68","value":".?AVICompletionPortEventSink@Proud@@"},{"address":"0x140155af8","value":".?AVIVizAgentDg@Proud@@"},{"address":"0x140155b48","value":".?AVProxy@CNetServerImpl@Proud@@"},{"address":"0x140155ba8","value":".?AVCNetServer@Proud@@"},{"address":"0x140155bd0","value":".?AVC2SStub@CNetServerImpl@Proud@@"},{"address":"0x140155dd0","value":".?AV?$CFastArray@UConnectionInfo@CNetServerImpl@Proud@@$0A@@Proud@@"},{"address":"0x140155e60","value":".?AV?$CFastArray@PEAVP2PConnectionState@Proud@@$0A@@Proud@@"},{"address":"0x140155ff0","value":".?AVCNetServerImpl@Proud@@"},{"address":"0x140156250","value":".?AVIUdpPacketFragBoardDg@Proud@@"},{"address":"0x140156288","value":".?AVIUdpPacketDefragBoardDg@Proud@@"},{"address":"0x1401562c0","value":".?AVStateBase@CP2PConnectionTrialContext@Proud@@"},{"address":"0x140156420","value":".?AVPeerHolepunchState@CP2PConnectionTrialContext@Proud@@"},{"address":"0x1401564a0","value":".?AVServerAsSendDest@CNetClientImpl@Proud@@"},{"address":"0x140156b58","value":".?AVCVizAgent@Proud@@"},{"address":"0x140156ca0","value":".?AV?$CFastArray@PEAVUdpPacketCtx@Proud@@$00@Proud@@"},{"address":"0x140156f18","value":".?AVCNetClientManager@Proud@@"},{"address":"0x140156f50","value":".?AV?$CSafeSingleton@VCNetClientManager@Proud@@@Proud@@"},{"address":"0x140157170","value":".?AVServerHolepunchState@CP2PConnectionTrialContext@Proud@@"},{"address":"0x140157470","value":".?AVMagiServerBase@@"},{"address":"0x140157520","value":".?AV?$MBISingleton@VMagiAgentServer@@@@"},{"address":"0x140157558","value":".?AVMagiAgentServer@@"},{"address":"0x14015b1a0","value":".?AVStub@SERVER2AGENT_PROTOCOL@@"},{"address":"0x14015b1d8","value":".?AVServer2AgentStub@RNP@@"},{"address":"0x14015b208","value":".?AVINetServerEvent@Proud@@"},{"address":"0x14015b238","value":".?AVMagiBaseServerNetwork@@"},{"address":"0x14015b268","value":".?AVMagiAgentNetwork@@"},{"address":"0x14015b290","value":".?AVStub@AGENTMANAGER2AGENT_PROTOCOL@@"},{"address":"0x14015b2c8","value":".?AVAgentManager2AgentStub@RNP@@"},{"address":"0x14015b300","value":".?AVMGAgentManagerSession@@"},{"address":"0x14015b330","value":".?AV?$MBISingleton@VMagiAgentProcess@@@@"},{"address":"0x14015b370","value":".?AVMagiAgentProcess@@"},{"address":"0x14015b880","value":".?AVIObserver@@"},{"address":"0x14015b8a0","value":".?AVAgent2ServerProxy@RNP@@"},{"address":"0x14015b8f8","value":".?AVProxy@AGENT2SERVER_PROTOCOL@@"},{"address":"0x14015b958","value":".?AVAgent2AgentManagerProxy@RNP@@"},{"address":"0x14015b990","value":".?AVProxy@AGENT2AGENTMANAGER_PROTOCOL@@"},{"address":"0x14015b9c8","value":".?AV?$MBISingleton@VMagiServerOption@@@@"},{"address":"0x14015ba08","value":".?AVMagiServerOption@@"},{"address":"0x14015bc28","value":".?AV?$MBISingleton@VMagiServerFile@@@@"},{"address":"0x14015bc60","value":".?AVMagiServerFile@@"},{"address":"0x14015bd20","value":".?AV?$MBISingleton@VMagiServerManager@@@@"},{"address":"0x14015bd60","value":".?AVMagiServerManager@@"},{"address":"0x14015bd88","value":".?AV?$MBISingleton@VMagiAgentCommon@@@@"},{"address":"0x14015bdc0","value":".?AVMagiAgentCommon@@"}],"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_62a2f5bb36c415a8e00d961ca75fe22a341aaecdf4e878d93eaa846aa9dfbdd9","evidence_links":[],"limitations":["Derived by an REA composed workflow.","An exact external entry resolves to its observed function identity even when its body is empty. This does not establish mapped executable bytes or containment of nearby external addresses.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","Synthetic Ghidra entry-point references without actionable memory sources are omitted.","The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"matches":[{"address":"0x14011d008","type":"string","value":"FAILED SERVER ON %s "}],"query":"FAILED SERVER ON","references":[{"containing_procedure":{"found":true,"procedure":{"address":"0x140008ea0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x1400094a3","start":"0x140008ea0"}],"span_bytes":1540,"total_bytes":1540},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_140008ea0"},"query_address":"0x1400093c8"},"source_address":"0x1400093c8","target_address":"0x14011d008"}],"residual_unknowns":[],"search_mode":"literal","truncated":false},"operation":"trace_feature","parameters":{"case_sensitive":true,"query":"FAILED SERVER ON"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_63966e8a14f873bcf590e501b8a4b23129a3264a79916dfc9e87b414ae307d53","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Bytes reflect Ghidra's initialized memory, including loader fixups. Reads stop at an unmapped or uninitialized byte and report completeness explicitly.","The target references PDB MessageServer_Release_x64.pdb (GUID cde07e33-d76f-49e7-887c-43afecaef251, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"address":"0x1401593d0","bytes_hex":"500056005000000057004100520000004700750069006c0064000000000000004d00650073007300610067006500000047004d0000000000","complete":true,"requested_bytes":56,"returned_bytes":56},"operation":"read_bytes","parameters":{"address":"0x1401593d0","length":56},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":{"address":"0x1401593d0","bytes_hex":"500056005000000057004100520000004700750069006c0064000000000000004d00650073007300610067006500000047004d0000000000","complete":true,"requested_bytes":56,"returned_bytes":56},"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/MessageServer_Release_x64.exe","name":"MessageServer_Release_x64.exe"}},{"analysis_profile":{"digest":"cafbfc97291d6d40b0e888c8d704f6ef1097cd0427b43ca85205640dfedb4533","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}}},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_78062312c34a02d663fbfa0cc184c4e6d02554a4e3f9dabf21a44c431bb01acd","evidence_links":[],"limitations":["Derived by an REA composed workflow.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The symbol inventory includes memory and external symbols, including dynamic symbols, but excludes variable and no-address namespace records.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"name":"CreateMutexW","reason":"name_not_found","status":"unresolved"},"operation":"find_xrefs_to_name","parameters":{"name":"CreateMutexW"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"cafbfc97291d6d40b0e888c8d704f6ef1097cd0427b43ca85205640dfedb4533","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}}},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_9605517ddb290aa7c2f6d4b283feb2423309fc0ca8ff2ced04a8a131d6c765d5","evidence_links":[],"limitations":["Derived by an REA composed workflow.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The symbol inventory includes memory and external symbols, including dynamic symbols, but excludes variable and no-address namespace records.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"name":"TerminateProcess","reason":"name_not_found","status":"unresolved"},"operation":"find_xrefs_to_name","parameters":{"name":"TerminateProcess"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"cafbfc97291d6d40b0e888c8d704f6ef1097cd0427b43ca85205640dfedb4533","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}}},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_9e39360a43160ed00bccf5bff4c3ca1b5dfac3c506641cd1c87c81b8892dc77a","evidence_links":[],"limitations":["Derived by an REA composed workflow.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The symbol inventory includes memory and external symbols, including dynamic symbols, but excludes variable and no-address namespace records.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"name":"CreateProcessW","reason":"name_not_found","status":"unresolved"},"operation":"find_xrefs_to_name","parameters":{"name":"CreateProcessW"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"3decca45d3460a9d91b48bfb293ee703f84841379edceee6350b1ea3393d3fe1","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":3},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_9fe3a449c6aa867adaabf1b34be9967bba78f98a7d72bc69f9fab835fb7db03b","evidence_links":[],"limitations":["Derived by an REA composed workflow.","A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"document":"target-6f2be7b8eb79.exe","image_base":"0x140000000","procedure_count":6814,"segment_count":9,"segments":[{"address_space":"ram","end":"0x140000400","image_base":"0x140000000","length":1024,"name":"Headers","start":"0x140000000"},{"address_space":"ram","end":"0x1400f1a00","image_base":"0x140000000","length":985600,"name":".text","start":"0x140001000"},{"address_space":"ram","end":"0x140154200","image_base":"0x140000000","length":401920,"name":".rdata","start":"0x1400f2000"},{"address_space":"ram","end":"0x140163450","image_base":"0x140000000","length":58448,"name":".data","start":"0x140155000"},{"address_space":"ram","end":"0x14016ee00","image_base":"0x140000000","length":44544,"name":".pdata","start":"0x140164000"},{"address_space":"ram","end":"0x14016f200","image_base":"0x140000000","length":512,"name":".tls","start":"0x14016f000"},{"address_space":"ram","end":"0x140170200","image_base":"0x140000000","length":512,"name":".rsrc","start":"0x140170000"},{"address_space":"ram","end":"0x140173600","image_base":"0x140000000","length":9728,"name":".reloc","start":"0x140171000"},{"address_space":"ram","end":"0xff00001850","image_base":"0x140000000","length":6224,"name":"tdb","start":"0xff00000000"}],"string_count":1472},"operation":"binary_overview","parameters":{},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_ad71d730ad826f5e73d5b5ec119273acf91c525002d977f0d017bc11eb2cfbb4","evidence_links":[],"limitations":["Derived by an REA composed workflow.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[{"address":"0x140009780","kind":"address"},{"address":"0x1400100b0","kind":"address"},{"address":"0x140008c90","kind":"address"}],"normalized_result":{"failed":0,"items":[{"address":"0x140009780","procedure":{"address":"0x140009780","name":"FUN_140009780","status":"resolved"},"pseudocode":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n\nulonglong FUN_140009780(wchar_t *param_1)\n\n{\n int iVar1;\n BOOL BVar2;\n HANDLE hObject;\n HANDLE hProcess;\n undefined4 extraout_var;\n undefined4 extraout_var_00;\n undefined1 auStack_278 [32];\n undefined4 local_258 [2];\n DWORD local_250;\n wchar_t local_22c [266];\n ulonglong local_18;\n \n local_18 = DAT_1401555a0 ^ (ulonglong)auStack_278;\n if (param_1 != (wchar_t *)0x0) {\n hObject = (HANDLE)CreateToolhelp32Snapshot(2);\n memset(local_258,0,0x238);\n local_258[0] = 0x238;\n iVar1 = Process32FirstW(hObject,local_258);\n while (iVar1 != 0) {\n iVar1 = _wcsicmp(param_1,local_22c);\n if ((iVar1 == 0) &&\n (hProcess = OpenProcess(1,0,local_250), hProcess != (HANDLE)0xffffffffffffffff)) {\n wprintf(L\"Process Kill.!!! [%s] \\n\");\n TerminateProcess(hProcess,0);\n BVar2 = CloseHandle(hProcess);\n return CONCAT71((int7)(CONCAT44(extraout_var_00,BVar2) >> 8),1);\n }\n iVar1 = Process32NextW(hObject,local_258);\n }\n BVar2 = CloseHandle(hObject);\n local_18 = CONCAT44(extraout_var,BVar2);\n }\n return local_18 & 0xffffffffffffff00;\n}\n\n","status":"ok"},{"address":"0x1400100b0","procedure":{"address":"0x1400100b0","name":"FUN_1400100b0","status":"resolved"},"pseudocode":"\nundefined4 FUN_1400100b0(undefined8 *param_1)\n\n{\n DWORD DVar1;\n uint extraout_EAX;\n HANDLE pvVar2;\n wchar_t *_Format;\n \n pvVar2 = CreateMutexW((LPSECURITY_ATTRIBUTES)0x0,1,L\"Global\\\\RustyHearts_Agent\");\n *param_1 = pvVar2;\n DVar1 = GetLastError();\n if (DVar1 == 5) {\n _Format = L\"ERROR_ACCESS_DENIED!!! %s \\n\";\n }\n else {\n if (DVar1 != 0xb7) {\n return CONCAT31((int3)(DVar1 >> 8),1);\n }\n _Format = L\"ERROR_ALREADY_EXISTS!!! %s \\n\";\n }\n wprintf(_Format);\n Sleep(3000);\n return extraout_EAX & 0xffffff00;\n}\n\n","status":"ok"},{"address":"0x140008c90","procedure":{"address":"0x140008c90","name":"FUN_140008c90","status":"resolved"},"pseudocode":"\nundefined8 FUN_140008c90(undefined8 *param_1)\n\n{\n DWORD DVar1;\n HANDLE hProcess;\n undefined4 *puVar2;\n undefined8 *puVar3;\n longlong lVar4;\n longlong lVar5;\n uint *puVar6;\n undefined *puVar7;\n uint *puVar8;\n uint local_res8 [2];\n DWORD local_res10 [2];\n undefined8 *local_res18;\n undefined8 *local_res20;\n undefined8 local_118;\n undefined8 local_110;\n undefined8 local_108;\n undefined8 local_100;\n undefined8 local_f8;\n undefined8 local_f0 [4];\n undefined4 local_d0 [44];\n \n local_f8 = 0xfffffffffffffffe;\n hProcess = (HANDLE)*param_1;\n DVar1 = *(DWORD *)(param_1 + 2);\n local_res10[0] = DVar1;\n do {\n Sleep(10);\n GetExitCodeProcess(hProcess,local_res10);\n } while (local_res10[0] == 0x103);\n puVar2 = (undefined4 *)FUN_14002c9a0(DAT_140162d60,DVar1);\n if (puVar2 == (undefined4 *)0x0) {\n wprintf(L\"NOT FIND PROCESS ID \\n\");\n }\n else {\n lVar5 = *(longlong *)(DAT_1401626f8 + 0xa8);\n if (lVar5 != 0) {\n puVar2[0x28] = 0;\n puVar2[0x31] = 0;\n local_res18 = local_f0;\n puVar3 = FUN_140006c30((longlong)puVar2,local_f0);\n local_118 = *(undefined8 *)(puVar2 + 0x2e);\n local_110 = *(undefined8 *)(puVar2 + 0x30);\n local_108 = *(undefined8 *)(puVar2 + 0x32);\n local_100 = *(undefined8 *)(puVar2 + 0x34);\n local_res8[0] = puVar2[1];\n local_res20 = puVar3;\n lVar4 = FUN_140007fa0(lVar5);\n (**(code **)(*(longlong *)(lVar4 + 0x68) + 0x40))\n ((longlong *)(lVar4 + 0x68),1,&DAT_1401555d0,local_res8,&local_118,puVar3);\n if ((void *)*puVar3 != (void *)0x0) {\n operator_delete((void *)*puVar3);\n }\n *puVar3 = 0;\n puVar3[1] = 0;\n puVar3[2] = 0;\n local_res20 = (undefined8 *)CONCAT44(local_res20._4_4_,1);\n local_res18 = (undefined8 *)CONCAT44(local_res18._4_4_,puVar2[1]);\n local_res8[0] = CONCAT31(local_res8[0]._1_3_,1);\n lVar5 = FUN_140007fa0(lVar5);\n puVar8 = local_res8;\n puVar7 = &DAT_1401555d0;\n (**(code **)(*(longlong *)(lVar5 + 0x68) + 0x50))\n ((longlong *)(lVar5 + 0x68),1,&DAT_1401555d0,puVar8,&local_res20,&local_res18);\n if ((*(char *)((longlong)puVar2 + 0xd5) != '\\0') || (*(char *)(DAT_140162d68 + 0x171) != '\\0')\n ) {\n puVar6 = FUN_14000b8e0(puVar2,local_d0);\n FUN_140008ea0(DAT_140162d78,puVar6,puVar7,puVar8);\n if ((*(char *)(puVar2 + 3) == '\\x01') && (0 < (int)puVar2[0x34])) {\n FUN_140009f20(DAT_140162d78,puVar2[1]);\n }\n }\n }\n }\n return 0;\n}\n\n","status":"ok"}],"succeeded":3,"total":3},"operation":"batch_decompile","parameters":{"addresses":["0x140009780","0x1400100b0","0x140008c90"]},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_d4bb4bc3e293a80f83ed3864e452cae8160698fd58063de231a62c97cd7bf0eb","evidence_links":[],"limitations":["Derived by an REA composed workflow.","An exact external entry resolves to its observed function identity even when its body is empty. This does not establish mapped executable bytes or containment of nearby external addresses.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","Synthetic Ghidra entry-point references without actionable memory sources are omitted.","The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"matches":[{"address":"0x14011f558","type":"string","value":"option\\agent.xml"}],"query":"option\\agent.xml","references":[{"containing_procedure":{"found":true,"procedure":{"address":"0x1400f06e0","body":{"available":true,"contains_entry":true,"non_contiguous":false,"provenance":"ghidra-function-body-address-set","ranges":[{"end":"0x1400f0753","start":"0x1400f06e0"}],"span_bytes":116,"total_bytes":116},"classification":{"external":false,"provenance":"ghidra-function-manager","thunk":false,"thunk_target":null},"name":"FUN_1400f06e0"},"query_address":"0x1400f0704"},"source_address":"0x1400f0704","target_address":"0x14011f558"}],"residual_unknowns":[],"search_mode":"literal","truncated":false},"operation":"trace_feature","parameters":{"case_sensitive":true,"query":"option\\agent.xml"},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_e77cf4b520f4fa0b88408c03b2bdd27ca462d9ca84b0de51180cb56c85771b34","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n\nDWORD FUN_1400094e0(wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)\n\n{\n int *piVar1;\n wchar_t wVar2;\n BOOL BVar3;\n longlong *plVar4;\n int *piVar5;\n HANDLE hObject;\n ulonglong uVar6;\n wchar_t *pwVar7;\n LPWSTR lpCommandLine;\n undefined8 uVar8;\n DWORD DVar9;\n wchar_t *pwVar10;\n code *pcVar11;\n undefined8 uVar12;\n _PROCESS_INFORMATION *_ArgList;\n undefined1 auStackY_538 [32];\n undefined *local_4e8;\n _PROCESS_INFORMATION local_4e0;\n int *local_4c8;\n undefined1 local_4c0;\n undefined8 local_4b8;\n _STARTUPINFOW local_4a8;\n wchar_t local_438;\n undefined1 local_436 [526];\n wchar_t local_228;\n undefined1 local_226 [526];\n ulonglong local_18;\n \n local_4b8 = 0xfffffffffffffffe;\n local_18 = DAT_1401555a0 ^ (ulonglong)auStackY_538;\n DVar9 = 0;\n local_228 = L'\\0';\n memset(local_226,0,0x206);\n local_438 = L'\\0';\n memset(local_436,0,0x206);\n uVar6 = 0xffffffffffffffff;\n pwVar10 = param_1;\n do {\n if (uVar6 == 0) break;\n uVar6 = uVar6 - 1;\n wVar2 = *pwVar10;\n pwVar10 = pwVar10 + 1;\n } while (wVar2 != L'\\0');\n uVar6 = ~uVar6;\n wcscpy_s(&local_228,uVar6,param_1);\n plVar4 = FUN_14002fe90((longlong *)&local_4e8,uVar6,param_1,param_4);\n pwVar10 = (wchar_t *)*plVar4;\n if ((wchar_t *)*plVar4 == (wchar_t *)0x0) {\n pwVar10 = (wchar_t *)PTR_DAT_140155010;\n }\n pwVar7 = &local_438;\n wcscpy_s(&local_438,0x104,pwVar10);\n if (((local_4e8 != (undefined *)0x0) && (local_4e8 != PTR_DAT_140155010)) &&\n (local_4e8 + -8 != (undefined *)0x0)) {\n piVar5 = (int *)FUN_140030200(pwVar7,local_4e8,pwVar10,param_4);\n local_4c8 = piVar5;\n FUN_14002e6e0(piVar5);\n local_4c0 = 1;\n piVar1 = (int *)(local_4e8 + -4);\n *piVar1 = *piVar1 + -1;\n if (*piVar1 == 0) {\n FUN_1400302f0(local_4e8 + -8);\n }\n FUN_14002e770((longlong)piVar5);\n }\n memset(&local_4a8,0,0x68);\n local_4a8.cb = 0x68;\n local_4a8.dwFlags = 0x13;\n local_4a8.dwXSize = 700;\n local_4a8.dwYSize = 0x6e;\n local_4a8.dwFillAttribute = 0x17;\n local_4a8.wShowWindow = 5;\n uVar12 = 0;\n uVar8 = 0;\n lpCommandLine = &local_228;\n BVar3 = CreateProcessW((LPCWSTR)0x0,lpCommandLine,(LPSECURITY_ATTRIBUTES)0x0,\n (LPSECURITY_ATTRIBUTES)0x0,0,0x10,(LPVOID)0x0,&local_438,&local_4a8,\n &local_4e0);\n if (BVar3 == 0) {\n FUN_140010aa0(L\"=======Server Fail=======\\n\",lpCommandLine,uVar8,uVar12);\n FUN_140010aa0(L\"Path\\t: [%s] \\n\",&local_438,uVar8,uVar12);\n FUN_140010aa0(L\"File\\t: [%s] \\n\",&local_228,uVar8,uVar12);\n }\n else {\n CloseHandle(local_4e0.hThread);\n _ArgList = &local_4e0;\n pcVar11 = FUN_140008c90;\n uVar8 = 0;\n hObject = (HANDLE)_beginthreadex((void *)0x0,0,FUN_140008c90,_ArgList,0,(uint *)&local_4e8);\n CloseHandle(hObject);\n FUN_140010aa0(L\"=======ServerOn=======\\n\",uVar8,pcVar11,_ArgList);\n DVar9 = local_4e0.dwProcessId;\n }\n printf(\"//////////////////////////////////////////////////////////////////////////\\n\");\n Sleep(1000);\n return DVar9;\n}\n\n","operation":"procedure_pseudo_code","parameters":{"procedure":"0x1400094e0"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":{"limitations":[],"value":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n\nDWORD FUN_1400094e0(wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)\n\n{\n int *piVar1;\n wchar_t wVar2;\n BOOL BVar3;\n longlong *plVar4;\n int *piVar5;\n HANDLE hObject;\n ulonglong uVar6;\n wchar_t *pwVar7;\n LPWSTR lpCommandLine;\n undefined8 uVar8;\n DWORD DVar9;\n wchar_t *pwVar10;\n code *pcVar11;\n undefined8 uVar12;\n _PROCESS_INFORMATION *_ArgList;\n undefined1 auStackY_538 [32];\n undefined *local_4e8;\n _PROCESS_INFORMATION local_4e0;\n int *local_4c8;\n undefined1 local_4c0;\n undefined8 local_4b8;\n _STARTUPINFOW local_4a8;\n wchar_t local_438;\n undefined1 local_436 [526];\n wchar_t local_228;\n undefined1 local_226 [526];\n ulonglong local_18;\n \n local_4b8 = 0xfffffffffffffffe;\n local_18 = DAT_1401555a0 ^ (ulonglong)auStackY_538;\n DVar9 = 0;\n local_228 = L'\\0';\n memset(local_226,0,0x206);\n local_438 = L'\\0';\n memset(local_436,0,0x206);\n uVar6 = 0xffffffffffffffff;\n pwVar10 = param_1;\n do {\n if (uVar6 == 0) break;\n uVar6 = uVar6 - 1;\n wVar2 = *pwVar10;\n pwVar10 = pwVar10 + 1;\n } while (wVar2 != L'\\0');\n uVar6 = ~uVar6;\n wcscpy_s(&local_228,uVar6,param_1);\n plVar4 = FUN_14002fe90((longlong *)&local_4e8,uVar6,param_1,param_4);\n pwVar10 = (wchar_t *)*plVar4;\n if ((wchar_t *)*plVar4 == (wchar_t *)0x0) {\n pwVar10 = (wchar_t *)PTR_DAT_140155010;\n }\n pwVar7 = &local_438;\n wcscpy_s(&local_438,0x104,pwVar10);\n if (((local_4e8 != (undefined *)0x0) && (local_4e8 != PTR_DAT_140155010)) &&\n (local_4e8 + -8 != (undefined *)0x0)) {\n piVar5 = (int *)FUN_140030200(pwVar7,local_4e8,pwVar10,param_4);\n local_4c8 = piVar5;\n FUN_14002e6e0(piVar5);\n local_4c0 = 1;\n piVar1 = (int *)(local_4e8 + -4);\n *piVar1 = *piVar1 + -1;\n if (*piVar1 == 0) {\n FUN_1400302f0(local_4e8 + -8);\n }\n FUN_14002e770((longlong)piVar5);\n }\n memset(&local_4a8,0,0x68);\n local_4a8.cb = 0x68;\n local_4a8.dwFlags = 0x13;\n local_4a8.dwXSize = 700;\n local_4a8.dwYSize = 0x6e;\n local_4a8.dwFillAttribute = 0x17;\n local_4a8.wShowWindow = 5;\n uVar12 = 0;\n uVar8 = 0;\n lpCommandLine = &local_228;\n BVar3 = CreateProcessW((LPCWSTR)0x0,lpCommandLine,(LPSECURITY_ATTRIBUTES)0x0,\n (LPSECURITY_ATTRIBUTES)0x0,0,0x10,(LPVOID)0x0,&local_438,&local_4a8,\n &local_4e0);\n if (BVar3 == 0) {\n FUN_140010aa0(L\"=======Server Fail=======\\n\",lpCommandLine,uVar8,uVar12);\n FUN_140010aa0(L\"Path\\t: [%s] \\n\",&local_438,uVar8,uVar12);\n FUN_140010aa0(L\"File\\t: [%s] \\n\",&local_228,uVar8,uVar12);\n }\n else {\n CloseHandle(local_4e0.hThread);\n _ArgList = &local_4e0;\n pcVar11 = FUN_140008c90;\n uVar8 = 0;\n hObject = (HANDLE)_beginthreadex((void *)0x0,0,FUN_140008c90,_ArgList,0,(uint *)&local_4e8);\n CloseHandle(hObject);\n FUN_140010aa0(L\"=======ServerOn=======\\n\",uVar8,pcVar11,_ArgList);\n DVar9 = local_4e0.dwProcessId;\n }\n printf(\"//////////////////////////////////////////////////////////////////////////\\n\");\n Sleep(1000);\n return DVar9;\n}\n\n"},"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_e87b1dd73483b4679d62c8af5a049a4eba2945ad39d8d854566eb6f8725e1200","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","The target references PDB Agent_Release_x64.pdb (GUID a4775113-cf21-4c1c-9d58-7e61100fab96, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n/* WARNING: Type propagation algorithm not settling */\n\nvoid FUN_140008ea0(undefined8 param_1,uint *param_2,undefined8 param_3,uint *param_4)\n\n{\n char cVar1;\n wchar_t wVar2;\n ulonglong uVar3;\n DWORD DVar4;\n char *pcVar5;\n wchar_t *******pppppppwVar6;\n longlong lVar7;\n ulonglong uVar8;\n undefined8 uVar9;\n char *pcVar10;\n wchar_t *pwVar11;\n undefined8 *puVar12;\n short *psVar13;\n wchar_t *pwVar14;\n undefined1 auStack_488 [32];\n void **local_468;\n undefined8 *local_460;\n uint local_458 [2];\n undefined8 *local_450;\n undefined1 *local_448;\n undefined8 local_440;\n basic_ostream_> local_438 [136];\n basic_ios_> local_3b0 [104];\n uint *local_348;\n wchar_t *******local_340 [2];\n wchar_t ******local_330;\n wchar_t ******local_328;\n undefined2 local_318;\n undefined6 uStack_316;\n undefined8 local_308;\n ulonglong local_300;\n ulonglong local_2f0 [2];\n undefined8 local_2e0;\n ulonglong local_2d8;\n void *local_2c8;\n undefined8 local_2c0;\n undefined8 local_2b8;\n ulonglong local_2b0;\n ulonglong local_2a0 [2];\n undefined8 local_290;\n ulonglong local_288;\n ulonglong local_278 [2];\n undefined8 local_268;\n ulonglong local_260;\n wchar_t local_248;\n undefined1 local_246 [526];\n ulonglong local_38;\n \n local_440 = 0xfffffffffffffffe;\n local_38 = DAT_1401555a0 ^ (ulonglong)auStack_488;\n pwVar11 = (wchar_t *)0x0;\n DVar4 = 0;\n pwVar14 = pwVar11;\n if (*(longlong *)(DAT_140162d60 + 0x58) != 0) {\n for (puVar12 = *(undefined8 **)\n (*(longlong *)(DAT_140162d60 + 0x38) +\n ((ulonglong)(longlong)(int)param_2[1] % *(ulonglong *)(DAT_140162d60 + 0x40)) *\n 8); puVar12 != (undefined8 *)0x0; puVar12 = (undefined8 *)*puVar12) {\n if (param_2[1] == *(uint *)(puVar12 + 1)) {\n if (puVar12 != (undefined8 *)0x0) {\n pwVar14 = (wchar_t *)puVar12[2];\n }\n break;\n }\n }\n }\n local_348 = param_2;\n if (*(int *)(pwVar14 + 0x62) == 0) {\n pwVar14[0x62] = L'\\x01';\n pwVar14[99] = L'\\0';\n uVar3 = *(ulonglong *)(DAT_1401626f8 + 0xa8);\n local_248 = L'\\0';\n memset(local_246,0,0x206);\n FUN_14000a4b0(local_438);\n std::basic_ostream_>::operator<<(local_438,param_2[1]);\n FUN_14000a600((longlong)local_438,(void **)&local_318);\n for (pcVar5 = *(char **)(DAT_140162d58 + 8); pcVar5 != *(char **)(DAT_140162d58 + 0x10);\n pcVar5 = pcVar5 + 0x30) {\n if (*pcVar5 == (char)param_2[3]) {\n pwVar11 = (wchar_t *)(pcVar5 + 8);\n if (7 < *(ulonglong *)(pcVar5 + 0x20)) {\n pwVar11 = *(wchar_t **)pwVar11;\n }\n break;\n }\n }\n wcscpy_s(&local_248,0x104,pwVar11);\n wcscat_s(&local_248,0x104,L\" \");\n if (*(char *)(DAT_140162d68 + 0x152) == '\\0') {\n local_2d8 = 0xf;\n local_2e0 = 0;\n local_2f0[0]._0_1_ = '\\0';\n local_328 = (wchar_t ******)0x7;\n local_330 = (wchar_t ******)0x0;\n local_340[0] = (wchar_t *******)((ulonglong)local_340[0] & 0xffffffffffff0000);\n FUN_140027540(DAT_140162d68,local_2f0,param_2);\n pcVar5 = (char *)local_2f0;\n if (0xf < local_2d8) {\n pcVar5 = (char *)CONCAT71(local_2f0[0]._1_7_,(char)local_2f0[0]);\n }\n local_288 = 0xf;\n local_290 = 0;\n local_2a0[0]._0_1_ = '\\0';\n uVar8 = 0xffffffffffffffff;\n pcVar10 = pcVar5;\n do {\n if (uVar8 == 0) break;\n uVar8 = uVar8 - 1;\n cVar1 = *pcVar10;\n pcVar10 = pcVar10 + 1;\n } while (cVar1 != '\\0');\n FUN_14000b810(local_2a0,pcVar5,~uVar8 - 1);\n pppppppwVar6 = (wchar_t *******)FUN_1400dc8f0((ulonglong *)&local_2c8,(LPCSTR)local_2a0);\n if (local_340 != (wchar_t ********)pppppppwVar6) {\n if ((wchar_t ******)0x7 < local_328) {\n operator_delete(local_340[0]);\n }\n local_328 = (wchar_t ******)0x7;\n local_330 = (wchar_t ******)0x0;\n local_340[0] = (wchar_t *******)((ulonglong)local_340[0] & 0xffffffffffff0000);\n if (pppppppwVar6[3] < (wchar_t ******)0x8) {\n memmove(local_340,pppppppwVar6,((longlong)pppppppwVar6[2] + 1U) * 2);\n }\n else {\n local_340[0] = (wchar_t *******)*pppppppwVar6;\n *pppppppwVar6 = (wchar_t ******)0x0;\n }\n local_330 = pppppppwVar6[2];\n local_328 = pppppppwVar6[3];\n pppppppwVar6[3] = (wchar_t ******)0x7;\n pppppppwVar6[2] = (wchar_t ******)0x0;\n *(undefined2 *)pppppppwVar6 = 0;\n }\n if (7 < local_2b0) {\n operator_delete(local_2c8);\n }\n local_2b0 = 7;\n local_2b8 = 0;\n local_2c8 = (void *)((ulonglong)local_2c8 & 0xffffffffffff0000);\n if (0xf < local_288) {\n operator_delete((void *)CONCAT71(local_2a0[0]._1_7_,(CHAR)local_2a0[0]));\n }\n pppppppwVar6 = (wchar_t *******)local_340;\n if ((wchar_t ******)0x7 < local_328) {\n pppppppwVar6 = local_340[0];\n }\n uVar9 = 0x104;\n wcscat_s(&local_248,0x104,(wchar_t *)pppppppwVar6);\n if ((wchar_t ******)0x7 < local_328) {\n operator_delete(local_340[0]);\n }\n local_328 = (wchar_t ******)0x7;\n local_330 = (wchar_t ******)0x0;\n local_340[0] = (wchar_t *******)((ulonglong)local_340[0] & 0xffffffffffff0000);\n if (0xf < local_2d8) {\n operator_delete((void *)CONCAT71(local_2f0[0]._1_7_,(char)local_2f0[0]));\n }\n local_2d8 = 0xf;\n local_2e0 = 0;\n local_2f0[0]._0_1_ = '\\0';\n }\n else {\n pppppppwVar6 = (wchar_t *******)&local_318;\n if (7 < local_300) {\n pppppppwVar6 = (wchar_t *******)CONCAT62(uStack_316,local_318);\n }\n uVar9 = 0x104;\n wcscat_s(&local_248,0x104,(wchar_t *)pppppppwVar6);\n }\n uVar8 = 0xffffffffffffffff;\n pwVar11 = &local_248;\n do {\n if (uVar8 == 0) break;\n uVar8 = uVar8 - 1;\n wVar2 = *pwVar11;\n pwVar11 = pwVar11 + 1;\n } while (wVar2 != L'\\0');\n if ((~uVar8 < 0x104) &&\n (DVar4 = FUN_1400094e0(&local_248,uVar9,pppppppwVar6,param_4), 0 < (int)DVar4)) {\n *(DWORD *)(pwVar14 + 0x52) = DVar4;\n pwVar14[0x62] = L'\\x01';\n pwVar14[99] = L'\\0';\n local_448 = (undefined1 *)local_2a0;\n puVar12 = FUN_140006c30((longlong)pwVar14,local_2a0);\n local_2c8 = *(void **)(pwVar14 + 0x5c);\n local_2c0 = *(undefined8 *)(pwVar14 + 0x60);\n local_2b8 = *(undefined8 *)(pwVar14 + 100);\n local_2b0 = *(ulonglong *)(pwVar14 + 0x68);\n local_458[0] = *(uint *)(pwVar14 + 2);\n local_450 = puVar12;\n lVar7 = FUN_140007fa0(uVar3);\n local_468 = &local_2c8;\n param_4 = local_458;\n local_460 = puVar12;\n (**(code **)(*(longlong *)(lVar7 + 0x68) + 0x40))((longlong *)(lVar7 + 0x68),1,&DAT_1401555d0)\n ;\n if ((void *)*puVar12 != (void *)0x0) {\n operator_delete((void *)*puVar12);\n }\n *puVar12 = 0;\n puVar12[1] = 0;\n puVar12[2] = 0;\n }\n else {\n pwVar14[0x62] = L'\\0';\n pwVar14[99] = L'\\0';\n }\n if (uVar3 == 0) {\n if (7 < local_300) {\n operator_delete((void *)CONCAT62(uStack_316,local_318));\n }\n local_300 = 7;\n local_308 = 0;\n local_318 = 0;\n FUN_14000a550((longlong)local_3b0);\n std::basic_ios_>::\n ~basic_ios_>(local_3b0);\n }\n else if ((int)DVar4 < 1) {\n puVar12 = (undefined8 *)(DAT_140162d68 + 0x30);\n if (7 < *(ulonglong *)(DAT_140162d68 + 0x48)) {\n puVar12 = (undefined8 *)*puVar12;\n }\n FUN_1400dc9d0(local_278,L\"FAILED SERVER ON %s \",puVar12,param_4);\n psVar13 = (short *)local_278;\n if (7 < local_260) {\n psVar13 = (short *)CONCAT62(local_278[0]._2_6_,(short)local_278[0]);\n }\n FUN_1400080a0(uVar3,1,psVar13,param_4);\n if (7 < local_260) {\n operator_delete((void *)CONCAT62(local_278[0]._2_6_,(short)local_278[0]));\n }\n local_260 = 7;\n local_268 = 0;\n local_278[0]._0_2_ = 0;\n if (7 < local_300) {\n operator_delete((void *)CONCAT62(uStack_316,local_318));\n }\n local_300 = 7;\n local_308 = 0;\n local_318 = 0;\n FUN_14000a550((longlong)local_3b0);\n std::basic_ios_>::\n ~basic_ios_>(local_3b0);\n }\n else {\n if (7 < local_300) {\n operator_delete((void *)CONCAT62(uStack_316,local_318));\n }\n local_300 = 7;\n local_308 = 0;\n local_318 = 0;\n FUN_14000a550((longlong)local_3b0);\n std::basic_ios_>::\n ~basic_ios_>(local_3b0);\n }\n }\n FUN_140004e10((longlong)param_2);\n return;\n}\n\n","operation":"procedure_pseudo_code","parameters":{"procedure":"0x140008ea0"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":{"limitations":[],"value":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n/* WARNING: Type propagation algorithm not settling */\n\nvoid FUN_140008ea0(undefined8 param_1,uint *param_2,undefined8 param_3,uint *param_4)\n\n{\n char cVar1;\n wchar_t wVar2;\n ulonglong uVar3;\n DWORD DVar4;\n char *pcVar5;\n wchar_t *******pppppppwVar6;\n longlong lVar7;\n ulonglong uVar8;\n undefined8 uVar9;\n char *pcVar10;\n wchar_t *pwVar11;\n undefined8 *puVar12;\n short *psVar13;\n wchar_t *pwVar14;\n undefined1 auStack_488 [32];\n void **local_468;\n undefined8 *local_460;\n uint local_458 [2];\n undefined8 *local_450;\n undefined1 *local_448;\n undefined8 local_440;\n basic_ostream_> local_438 [136];\n basic_ios_> local_3b0 [104];\n uint *local_348;\n wchar_t *******local_340 [2];\n wchar_t ******local_330;\n wchar_t ******local_328;\n undefined2 local_318;\n undefined6 uStack_316;\n undefined8 local_308;\n ulonglong local_300;\n ulonglong local_2f0 [2];\n undefined8 local_2e0;\n ulonglong local_2d8;\n void *local_2c8;\n undefined8 local_2c0;\n undefined8 local_2b8;\n ulonglong local_2b0;\n ulonglong local_2a0 [2];\n undefined8 local_290;\n ulonglong local_288;\n ulonglong local_278 [2];\n undefined8 local_268;\n ulonglong local_260;\n wchar_t local_248;\n undefined1 local_246 [526];\n ulonglong local_38;\n \n local_440 = 0xfffffffffffffffe;\n local_38 = DAT_1401555a0 ^ (ulonglong)auStack_488;\n pwVar11 = (wchar_t *)0x0;\n DVar4 = 0;\n pwVar14 = pwVar11;\n if (*(longlong *)(DAT_140162d60 + 0x58) != 0) {\n for (puVar12 = *(undefined8 **)\n (*(longlong *)(DAT_140162d60 + 0x38) +\n ((ulonglong)(longlong)(int)param_2[1] % *(ulonglong *)(DAT_140162d60 + 0x40)) *\n 8); puVar12 != (undefined8 *)0x0; puVar12 = (undefined8 *)*puVar12) {\n if (param_2[1] == *(uint *)(puVar12 + 1)) {\n if (puVar12 != (undefined8 *)0x0) {\n pwVar14 = (wchar_t *)puVar12[2];\n }\n break;\n }\n }\n }\n local_348 = param_2;\n if (*(int *)(pwVar14 + 0x62) == 0) {\n pwVar14[0x62] = L'\\x01';\n pwVar14[99] = L'\\0';\n uVar3 = *(ulonglong *)(DAT_1401626f8 + 0xa8);\n local_248 = L'\\0';\n memset(local_246,0,0x206);\n FUN_14000a4b0(local_438);\n std::basic_ostream_>::operator<<(local_438,param_2[1]);\n FUN_14000a600((longlong)local_438,(void **)&local_318);\n for (pcVar5 = *(char **)(DAT_140162d58 + 8); pcVar5 != *(char **)(DAT_140162d58 + 0x10);\n pcVar5 = pcVar5 + 0x30) {\n if (*pcVar5 == (char)param_2[3]) {\n pwVar11 = (wchar_t *)(pcVar5 + 8);\n if (7 < *(ulonglong *)(pcVar5 + 0x20)) {\n pwVar11 = *(wchar_t **)pwVar11;\n }\n break;\n }\n }\n wcscpy_s(&local_248,0x104,pwVar11);\n wcscat_s(&local_248,0x104,L\" \");\n if (*(char *)(DAT_140162d68 + 0x152) == '\\0') {\n local_2d8 = 0xf;\n local_2e0 = 0;\n local_2f0[0]._0_1_ = '\\0';\n local_328 = (wchar_t ******)0x7;\n local_330 = (wchar_t ******)0x0;\n local_340[0] = (wchar_t *******)((ulonglong)local_340[0] & 0xffffffffffff0000);\n FUN_140027540(DAT_140162d68,local_2f0,param_2);\n pcVar5 = (char *)local_2f0;\n if (0xf < local_2d8) {\n pcVar5 = (char *)CONCAT71(local_2f0[0]._1_7_,(char)local_2f0[0]);\n }\n local_288 = 0xf;\n local_290 = 0;\n local_2a0[0]._0_1_ = '\\0';\n uVar8 = 0xffffffffffffffff;\n pcVar10 = pcVar5;\n do {\n if (uVar8 == 0) break;\n uVar8 = uVar8 - 1;\n cVar1 = *pcVar10;\n pcVar10 = pcVar10 + 1;\n } while (cVar1 != '\\0');\n FUN_14000b810(local_2a0,pcVar5,~uVar8 - 1);\n pppppppwVar6 = (wchar_t *******)FUN_1400dc8f0((ulonglong *)&local_2c8,(LPCSTR)local_2a0);\n if (local_340 != (wchar_t ********)pppppppwVar6) {\n if ((wchar_t ******)0x7 < local_328) {\n operator_delete(local_340[0]);\n }\n local_328 = (wchar_t ******)0x7;\n local_330 = (wchar_t ******)0x0;\n local_340[0] = (wchar_t *******)((ulonglong)local_340[0] & 0xffffffffffff0000);\n if (pppppppwVar6[3] < (wchar_t ******)0x8) {\n memmove(local_340,pppppppwVar6,((longlong)pppppppwVar6[2] + 1U) * 2);\n }\n else {\n local_340[0] = (wchar_t *******)*pppppppwVar6;\n *pppppppwVar6 = (wchar_t ******)0x0;\n }\n local_330 = pppppppwVar6[2];\n local_328 = pppppppwVar6[3];\n pppppppwVar6[3] = (wchar_t ******)0x7;\n pppppppwVar6[2] = (wchar_t ******)0x0;\n *(undefined2 *)pppppppwVar6 = 0;\n }\n if (7 < local_2b0) {\n operator_delete(local_2c8);\n }\n local_2b0 = 7;\n local_2b8 = 0;\n local_2c8 = (void *)((ulonglong)local_2c8 & 0xffffffffffff0000);\n if (0xf < local_288) {\n operator_delete((void *)CONCAT71(local_2a0[0]._1_7_,(CHAR)local_2a0[0]));\n }\n pppppppwVar6 = (wchar_t *******)local_340;\n if ((wchar_t ******)0x7 < local_328) {\n pppppppwVar6 = local_340[0];\n }\n uVar9 = 0x104;\n wcscat_s(&local_248,0x104,(wchar_t *)pppppppwVar6);\n if ((wchar_t ******)0x7 < local_328) {\n operator_delete(local_340[0]);\n }\n local_328 = (wchar_t ******)0x7;\n local_330 = (wchar_t ******)0x0;\n local_340[0] = (wchar_t *******)((ulonglong)local_340[0] & 0xffffffffffff0000);\n if (0xf < local_2d8) {\n operator_delete((void *)CONCAT71(local_2f0[0]._1_7_,(char)local_2f0[0]));\n }\n local_2d8 = 0xf;\n local_2e0 = 0;\n local_2f0[0]._0_1_ = '\\0';\n }\n else {\n pppppppwVar6 = (wchar_t *******)&local_318;\n if (7 < local_300) {\n pppppppwVar6 = (wchar_t *******)CONCAT62(uStack_316,local_318);\n }\n uVar9 = 0x104;\n wcscat_s(&local_248,0x104,(wchar_t *)pppppppwVar6);\n }\n uVar8 = 0xffffffffffffffff;\n pwVar11 = &local_248;\n do {\n if (uVar8 == 0) break;\n uVar8 = uVar8 - 1;\n wVar2 = *pwVar11;\n pwVar11 = pwVar11 + 1;\n } while (wVar2 != L'\\0');\n if ((~uVar8 < 0x104) &&\n (DVar4 = FUN_1400094e0(&local_248,uVar9,pppppppwVar6,param_4), 0 < (int)DVar4)) {\n *(DWORD *)(pwVar14 + 0x52) = DVar4;\n pwVar14[0x62] = L'\\x01';\n pwVar14[99] = L'\\0';\n local_448 = (undefined1 *)local_2a0;\n puVar12 = FUN_140006c30((longlong)pwVar14,local_2a0);\n local_2c8 = *(void **)(pwVar14 + 0x5c);\n local_2c0 = *(undefined8 *)(pwVar14 + 0x60);\n local_2b8 = *(undefined8 *)(pwVar14 + 100);\n local_2b0 = *(ulonglong *)(pwVar14 + 0x68);\n local_458[0] = *(uint *)(pwVar14 + 2);\n local_450 = puVar12;\n lVar7 = FUN_140007fa0(uVar3);\n local_468 = &local_2c8;\n param_4 = local_458;\n local_460 = puVar12;\n (**(code **)(*(longlong *)(lVar7 + 0x68) + 0x40))((longlong *)(lVar7 + 0x68),1,&DAT_1401555d0)\n ;\n if ((void *)*puVar12 != (void *)0x0) {\n operator_delete((void *)*puVar12);\n }\n *puVar12 = 0;\n puVar12[1] = 0;\n puVar12[2] = 0;\n }\n else {\n pwVar14[0x62] = L'\\0';\n pwVar14[99] = L'\\0';\n }\n if (uVar3 == 0) {\n if (7 < local_300) {\n operator_delete((void *)CONCAT62(uStack_316,local_318));\n }\n local_300 = 7;\n local_308 = 0;\n local_318 = 0;\n FUN_14000a550((longlong)local_3b0);\n std::basic_ios_>::\n ~basic_ios_>(local_3b0);\n }\n else if ((int)DVar4 < 1) {\n puVar12 = (undefined8 *)(DAT_140162d68 + 0x30);\n if (7 < *(ulonglong *)(DAT_140162d68 + 0x48)) {\n puVar12 = (undefined8 *)*puVar12;\n }\n FUN_1400dc9d0(local_278,L\"FAILED SERVER ON %s \",puVar12,param_4);\n psVar13 = (short *)local_278;\n if (7 < local_260) {\n psVar13 = (short *)CONCAT62(local_278[0]._2_6_,(short)local_278[0]);\n }\n FUN_1400080a0(uVar3,1,psVar13,param_4);\n if (7 < local_260) {\n operator_delete((void *)CONCAT62(local_278[0]._2_6_,(short)local_278[0]));\n }\n local_260 = 7;\n local_268 = 0;\n local_278[0]._0_2_ = 0;\n if (7 < local_300) {\n operator_delete((void *)CONCAT62(uStack_316,local_318));\n }\n local_300 = 7;\n local_308 = 0;\n local_318 = 0;\n FUN_14000a550((longlong)local_3b0);\n std::basic_ios_>::\n ~basic_ios_>(local_3b0);\n }\n else {\n if (7 < local_300) {\n operator_delete((void *)CONCAT62(uStack_316,local_318));\n }\n local_300 = 7;\n local_308 = 0;\n local_318 = 0;\n FUN_14000a550((longlong)local_3b0);\n std::basic_ios_>::\n ~basic_ios_>(local_3b0);\n }\n }\n FUN_140004e10((longlong)param_2);\n return;\n}\n\n"},"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/Agent_Release_x64.exe","name":"Agent_Release_x64.exe"}},{"analysis_profile":{"digest":"59ccbf78a7678313ce6b8dc5d2aff50bb87fd4c4da522e2f0de63ece7a22c57a","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_f3d6252d948bddc296e0ff4eae2994a6516b8f9909f64aad2e0360a8375305c2","evidence_links":[],"limitations":["Derived by an REA composed workflow.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB MessageServer_Release_x64.pdb (GUID cde07e33-d76f-49e7-887c-43afecaef251, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[{"address":"0x1400075d0","kind":"address"},{"address":"0x140007770","kind":"address"}],"normalized_result":{"failed":0,"items":[{"address":"0x1400075d0","procedure":{"address":"0x1400075d0","name":"FUN_1400075d0","status":"resolved"},"pseudocode":"\nundefined8 FUN_1400075d0(longlong param_1,undefined8 param_2,undefined8 param_3,longlong param_4)\n\n{\n undefined8 uVar1;\n LPVOID pvVar2;\n LPVOID pvVar3;\n ulonglong uVar4;\n undefined *puVar5;\n char *local_60;\n DWORD local_58;\n longlong local_50;\n undefined **local_48;\n longlong *local_40;\n LPVOID local_38;\n ulonglong local_30;\n undefined8 local_28;\n \n local_60 = \"REQ_MSG_WHISPER\";\n local_50 = *(longlong *)**(undefined8 **)(param_1 + 0x80) + 0x68;\n local_58 = timeGetTime();\n FUN_14006b350((int *)(param_1 + 0x108));\n local_48 = Proud::CFastArray::vftable;\n local_40 = (longlong *)0x0;\n local_38 = (LPVOID)0x0;\n local_30 = 0;\n local_28 = 0;\n FUN_140007480(param_1 + -8,(longlong)&local_48,param_3,param_4);\n pvVar3 = local_38;\n uVar4 = local_30 & 0xffffffff;\n pvVar2 = local_38;\n if ((int)local_30 == 0) {\n pvVar2 = (LPVOID)0x0;\n }\n puVar5 = &DAT_1401ac5d0;\n (**(code **)(*(longlong *)(param_1 + 0x58) + 0x28))();\n if (pvVar3 != (LPVOID)0x0) {\n if (local_40 == (longlong *)0x0) {\n FUN_14006cc60(pvVar3);\n }\n else {\n (**(code **)(*local_40 + 0x18))();\n pvVar2 = pvVar3;\n }\n }\n FUN_14006b3e0(param_1 + 0x108);\n uVar1 = FUN_1400486e0(&local_60,pvVar2,uVar4,puVar5);\n return CONCAT71((int7)((ulonglong)uVar1 >> 8),1);\n}\n\n","status":"ok"},{"address":"0x140007770","procedure":{"address":"0x140007770","name":"FUN_140007770","status":"resolved"},"pseudocode":"\nundefined8\nFUN_140007770(longlong param_1,undefined8 param_2,undefined8 param_3,uint *param_4,ulonglong param_5\n )\n\n{\n int *piVar1;\n uint uVar2;\n uint *puVar3;\n undefined8 uVar4;\n undefined *puVar5;\n undefined *puVar6;\n ulonglong uVar7;\n char *local_20;\n DWORD local_18;\n longlong local_10;\n \n local_20 = \"REQ_MSG_WHISPER_ACK\";\n local_10 = *(longlong *)**(undefined8 **)(param_1 + 0x80) + 0x68;\n local_18 = timeGetTime();\n piVar1 = (int *)(param_1 + 0x108);\n FUN_14006b350(piVar1);\n uVar2 = *param_4;\n uVar7 = (ulonglong)*(uint *)(param_1 + 0xd0);\n puVar6 = (undefined *)((ulonglong)uVar2 % uVar7);\n puVar5 = puVar6;\n if (*(longlong *)(param_1 + 0xb0) != 0) {\n puVar3 = *(uint **)(*(longlong *)(param_1 + 0xb0) + (longlong)puVar6 * 8);\n while( true ) {\n if ((puVar3 == (uint *)0x0) ||\n (puVar5 = (undefined *)((ulonglong)puVar3[8] % uVar7), (int)puVar6 != (int)puVar5))\n goto LAB_1400078af;\n if (*puVar3 == uVar2) break;\n puVar3 = *(uint **)(puVar3 + 4);\n }\n if (*(longlong *)(puVar3 + 2) != 0) {\n puVar6 = &DAT_1401ac5d0;\n puVar5 = (undefined *)(ulonglong)uVar2;\n (**(code **)(*(longlong *)(param_1 + 0x58) + 0x40))();\n FUN_14006b3e0((longlong)piVar1);\n goto LAB_1400078b8;\n }\n }\nLAB_1400078af:\n FUN_14006b3e0((longlong)piVar1);\n param_5 = uVar7;\nLAB_1400078b8:\n uVar4 = FUN_1400486e0(&local_20,puVar5,puVar6,param_5);\n return CONCAT71((int7)((ulonglong)uVar4 >> 8),1);\n}\n\n","status":"ok"}],"succeeded":2,"total":2},"operation":"batch_decompile","parameters":{"addresses":["0x1400075d0","0x140007770"]},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/MessageServer_Release_x64.exe","name":"MessageServer_Release_x64.exe"}}],"scenarios":[],"unknowns":[]}