226 lines
6.4 KiB
C
226 lines
6.4 KiB
C
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
|
|
* Ghidra 12.1.2 decompiler output for 0x14000a080 FUN_14000a080
|
|
* Pseudocode, not original source. */
|
|
|
|
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
|
|
|
|
void FUN_14000a080(undefined8 param_1,undefined8 param_2,ulonglong param_3,uint *param_4)
|
|
|
|
{
|
|
longlong lVar1;
|
|
wchar_t wVar2;
|
|
wchar_t *pwVar3;
|
|
wchar_t *pwVar4;
|
|
BOOL BVar5;
|
|
DWORD DVar6;
|
|
HANDLE hProcess;
|
|
char *pcVar7;
|
|
wchar_t *pwVar8;
|
|
ulonglong uVar9;
|
|
wchar_t *pwVar10;
|
|
wchar_t *pwVar11;
|
|
wchar_t *pwVar12;
|
|
undefined8 *puVar13;
|
|
short ******ppppppsVar14;
|
|
wchar_t *pwVar15;
|
|
undefined1 auStack_1c8 [32];
|
|
wchar_t *local_1a8;
|
|
wchar_t *local_1a0;
|
|
wchar_t *local_198;
|
|
wchar_t *local_190;
|
|
wchar_t *local_188;
|
|
wchar_t *local_180;
|
|
undefined8 local_170;
|
|
short *****local_168 [3];
|
|
ulonglong local_150;
|
|
undefined4 local_138 [10];
|
|
undefined2 local_110;
|
|
undefined6 uStack_10e;
|
|
undefined8 local_100;
|
|
ulonglong local_f8;
|
|
undefined2 local_e8;
|
|
undefined6 uStack_e6;
|
|
undefined8 local_d8;
|
|
ulonglong local_d0;
|
|
undefined2 local_c0;
|
|
undefined6 uStack_be;
|
|
undefined8 local_b0;
|
|
ulonglong local_a8;
|
|
undefined8 local_98;
|
|
ulonglong uStack_90;
|
|
ulonglong local_88;
|
|
ulonglong local_80;
|
|
ulonglong local_78;
|
|
ulonglong local_70;
|
|
ulonglong local_68;
|
|
void *local_60;
|
|
undefined8 local_58;
|
|
undefined8 local_50;
|
|
ulonglong local_38;
|
|
|
|
local_170 = 0xfffffffffffffffe;
|
|
local_38 = DAT_1401555a0 ^ (ulonglong)auStack_1c8;
|
|
*(undefined1 *)(DAT_140162d68 + 0x171) = 0;
|
|
printf("Auto Revive Off !!!\n");
|
|
pwVar10 = (wchar_t *)0x0;
|
|
DVar6 = 0;
|
|
local_190 = (wchar_t *)0x0;
|
|
local_188 = (wchar_t *)0x0;
|
|
local_180 = (wchar_t *)0x0;
|
|
pwVar8 = pwVar10;
|
|
pwVar11 = pwVar10;
|
|
pwVar15 = pwVar10;
|
|
if (*(longlong *)(DAT_140162d60 + 0x58) == 0) {
|
|
local_1a8 = (wchar_t *)0x0;
|
|
}
|
|
else {
|
|
local_1a8 = *(wchar_t **)(DAT_140162d60 + 0x68);
|
|
if (local_1a8 != (wchar_t *)0x0) {
|
|
local_1a0 = *(wchar_t **)local_1a8;
|
|
pwVar12 = local_1a8;
|
|
pwVar4 = local_1a0;
|
|
goto joined_r0x00014000a134;
|
|
}
|
|
}
|
|
local_1a0 = (wchar_t *)0x0;
|
|
pwVar12 = local_1a8;
|
|
pwVar4 = local_1a0;
|
|
joined_r0x00014000a134:
|
|
while (pwVar4 != (wchar_t *)0x0) {
|
|
pwVar3 = *(wchar_t **)(pwVar4 + 8);
|
|
if (pwVar3 != (wchar_t *)0x0) {
|
|
if ((pwVar3 < pwVar11) && (pwVar15 <= pwVar3)) {
|
|
lVar1 = ((longlong)pwVar3 - (longlong)pwVar15) +
|
|
SUB168(SEXT816(-0x7bdef7bdef7bdef7) * SEXT816((longlong)pwVar3 - (longlong)pwVar15),
|
|
8);
|
|
if (pwVar11 == pwVar8) {
|
|
FUN_14002d140((longlong *)&local_190);
|
|
pwVar11 = local_188;
|
|
pwVar15 = local_190;
|
|
}
|
|
local_1a8 = pwVar11;
|
|
local_198 = pwVar11;
|
|
if (pwVar11 != (wchar_t *)0x0) {
|
|
FUN_140004950((undefined4 *)pwVar11,
|
|
(undefined4 *)(pwVar15 + ((lVar1 >> 7) - (lVar1 >> 0x3f)) * 0x7c));
|
|
}
|
|
}
|
|
else {
|
|
if (pwVar11 == pwVar8) {
|
|
FUN_14002d140((longlong *)&local_190);
|
|
pwVar11 = local_188;
|
|
pwVar15 = local_190;
|
|
}
|
|
local_1a8 = pwVar11;
|
|
local_198 = pwVar11;
|
|
if (pwVar11 != (wchar_t *)0x0) {
|
|
FUN_140004950((undefined4 *)pwVar11,(undefined4 *)pwVar3);
|
|
}
|
|
}
|
|
pwVar11 = pwVar11 + 0x7c;
|
|
pwVar8 = local_180;
|
|
local_188 = pwVar11;
|
|
}
|
|
pwVar4 = *(wchar_t **)pwVar4;
|
|
while (pwVar4 == (wchar_t *)0x0) {
|
|
pwVar12 = pwVar12 + 4;
|
|
pwVar4 = *(wchar_t **)pwVar12;
|
|
}
|
|
if (pwVar12 == pwVar4) {
|
|
pwVar4 = pwVar10;
|
|
}
|
|
}
|
|
if (pwVar15 != pwVar11) {
|
|
pwVar8 = pwVar15 + 0x5c;
|
|
do {
|
|
FUN_140004ea0(local_138,(undefined4 *)(pwVar8 + -0x5c));
|
|
local_98 = *(ulonglong *)(pwVar8 + -0xc);
|
|
uStack_90 = *(ulonglong *)(pwVar8 + -8);
|
|
local_88 = *(ulonglong *)(pwVar8 + -4);
|
|
local_80 = *(ulonglong *)pwVar8;
|
|
local_78 = *(ulonglong *)(pwVar8 + 4);
|
|
local_70 = *(ulonglong *)(pwVar8 + 8);
|
|
local_68 = *(ulonglong *)(pwVar8 + 0xc);
|
|
FUN_140004d60(&local_60,(longlong *)(pwVar8 + 0x10));
|
|
param_3 = (ulonglong)local_98._4_4_;
|
|
hProcess = OpenProcess(0x1f0fff,0,local_98._4_4_);
|
|
if (hProcess != (HANDLE)0x0) {
|
|
BVar5 = GetExitCodeProcess(hProcess,(LPDWORD)&local_198);
|
|
if ((BVar5 != 0) && ((int)local_198 == 0x103)) {
|
|
TerminateProcess(hProcess,0);
|
|
}
|
|
CloseHandle(hProcess);
|
|
}
|
|
if (local_60 != (void *)0x0) {
|
|
operator_delete(local_60);
|
|
}
|
|
local_60 = (void *)0x0;
|
|
local_58 = 0;
|
|
local_50 = 0;
|
|
if (7 < local_a8) {
|
|
operator_delete((void *)CONCAT62(uStack_be,local_c0));
|
|
}
|
|
local_a8 = 7;
|
|
local_b0 = 0;
|
|
local_c0 = 0;
|
|
if (7 < local_d0) {
|
|
operator_delete((void *)CONCAT62(uStack_e6,local_e8));
|
|
}
|
|
local_d0 = 7;
|
|
local_d8 = 0;
|
|
local_e8 = 0;
|
|
if (7 < local_f8) {
|
|
operator_delete((void *)CONCAT62(uStack_10e,local_110));
|
|
}
|
|
local_f8 = 7;
|
|
local_100 = 0;
|
|
local_110 = 0;
|
|
pwVar4 = pwVar8 + 0x20;
|
|
pwVar8 = pwVar8 + 0x7c;
|
|
} while (pwVar4 != pwVar11);
|
|
}
|
|
FUN_140026820(DAT_140162d68);
|
|
for (pcVar7 = *(char **)(DAT_140162d58 + 8); pcVar7 != *(char **)(DAT_140162d58 + 0x10);
|
|
pcVar7 = pcVar7 + 0x30) {
|
|
if (*pcVar7 == '\x18') {
|
|
pwVar10 = (wchar_t *)(pcVar7 + 8);
|
|
if (7 < *(ulonglong *)(pcVar7 + 0x20)) {
|
|
pwVar10 = *(wchar_t **)pwVar10;
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
uVar9 = 0xffffffffffffffff;
|
|
pwVar8 = pwVar10;
|
|
do {
|
|
if (uVar9 == 0) break;
|
|
uVar9 = uVar9 - 1;
|
|
wVar2 = *pwVar8;
|
|
pwVar8 = pwVar8 + 1;
|
|
} while (wVar2 != L'\0');
|
|
if (~uVar9 < 0x104) {
|
|
DVar6 = FUN_1400094e0(pwVar10,pwVar10,param_3,param_4);
|
|
}
|
|
uVar9 = *(ulonglong *)(DAT_1401626f8 + 0xa8);
|
|
if ((uVar9 != 0) && ((int)DVar6 < 1)) {
|
|
puVar13 = (undefined8 *)(DAT_140162d68 + 0x30);
|
|
if (7 < *(ulonglong *)(DAT_140162d68 + 0x48)) {
|
|
puVar13 = (undefined8 *)*puVar13;
|
|
}
|
|
FUN_1400dc9d0((ulonglong *)local_168,L"SUCCEED PATCH ON %s",puVar13,param_4);
|
|
ppppppsVar14 = local_168;
|
|
if (7 < local_150) {
|
|
ppppppsVar14 = (short ******)local_168[0];
|
|
}
|
|
FUN_1400080a0(uVar9,2,(short *)ppppppsVar14,param_4);
|
|
if (7 < local_150) {
|
|
operator_delete(local_168[0]);
|
|
}
|
|
}
|
|
if (pwVar15 != (wchar_t *)0x0) {
|
|
FUN_140004b30((ulonglong *)pwVar15,(ulonglong *)pwVar11);
|
|
operator_delete(pwVar15);
|
|
}
|
|
return;
|
|
}
|
|
|