107 lines
3.3 KiB
C
107 lines
3.3 KiB
C
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
|
|
* Ghidra 12.1.2 pseudocode via REA, ev_e77cf4b520f4fa0b88408c03b2bdd27ca462d9ca84b0de51180cb56c85771b34
|
|
* Decompiler output, not original source. */
|
|
|
|
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
|
|
|
|
DWORD FUN_1400094e0(wchar_t *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
|
|
|
|
{
|
|
int *piVar1;
|
|
wchar_t wVar2;
|
|
BOOL BVar3;
|
|
longlong *plVar4;
|
|
int *piVar5;
|
|
HANDLE hObject;
|
|
ulonglong uVar6;
|
|
wchar_t *pwVar7;
|
|
LPWSTR lpCommandLine;
|
|
undefined8 uVar8;
|
|
DWORD DVar9;
|
|
wchar_t *pwVar10;
|
|
code *pcVar11;
|
|
undefined8 uVar12;
|
|
_PROCESS_INFORMATION *_ArgList;
|
|
undefined1 auStackY_538 [32];
|
|
undefined *local_4e8;
|
|
_PROCESS_INFORMATION local_4e0;
|
|
int *local_4c8;
|
|
undefined1 local_4c0;
|
|
undefined8 local_4b8;
|
|
_STARTUPINFOW local_4a8;
|
|
wchar_t local_438;
|
|
undefined1 local_436 [526];
|
|
wchar_t local_228;
|
|
undefined1 local_226 [526];
|
|
ulonglong local_18;
|
|
|
|
local_4b8 = 0xfffffffffffffffe;
|
|
local_18 = DAT_1401555a0 ^ (ulonglong)auStackY_538;
|
|
DVar9 = 0;
|
|
local_228 = L'\0';
|
|
memset(local_226,0,0x206);
|
|
local_438 = L'\0';
|
|
memset(local_436,0,0x206);
|
|
uVar6 = 0xffffffffffffffff;
|
|
pwVar10 = param_1;
|
|
do {
|
|
if (uVar6 == 0) break;
|
|
uVar6 = uVar6 - 1;
|
|
wVar2 = *pwVar10;
|
|
pwVar10 = pwVar10 + 1;
|
|
} while (wVar2 != L'\0');
|
|
uVar6 = ~uVar6;
|
|
wcscpy_s(&local_228,uVar6,param_1);
|
|
plVar4 = FUN_14002fe90((longlong *)&local_4e8,uVar6,param_1,param_4);
|
|
pwVar10 = (wchar_t *)*plVar4;
|
|
if ((wchar_t *)*plVar4 == (wchar_t *)0x0) {
|
|
pwVar10 = (wchar_t *)PTR_DAT_140155010;
|
|
}
|
|
pwVar7 = &local_438;
|
|
wcscpy_s(&local_438,0x104,pwVar10);
|
|
if (((local_4e8 != (undefined *)0x0) && (local_4e8 != PTR_DAT_140155010)) &&
|
|
(local_4e8 + -8 != (undefined *)0x0)) {
|
|
piVar5 = (int *)FUN_140030200(pwVar7,local_4e8,pwVar10,param_4);
|
|
local_4c8 = piVar5;
|
|
FUN_14002e6e0(piVar5);
|
|
local_4c0 = 1;
|
|
piVar1 = (int *)(local_4e8 + -4);
|
|
*piVar1 = *piVar1 + -1;
|
|
if (*piVar1 == 0) {
|
|
FUN_1400302f0(local_4e8 + -8);
|
|
}
|
|
FUN_14002e770((longlong)piVar5);
|
|
}
|
|
memset(&local_4a8,0,0x68);
|
|
local_4a8.cb = 0x68;
|
|
local_4a8.dwFlags = 0x13;
|
|
local_4a8.dwXSize = 700;
|
|
local_4a8.dwYSize = 0x6e;
|
|
local_4a8.dwFillAttribute = 0x17;
|
|
local_4a8.wShowWindow = 5;
|
|
uVar12 = 0;
|
|
uVar8 = 0;
|
|
lpCommandLine = &local_228;
|
|
BVar3 = CreateProcessW((LPCWSTR)0x0,lpCommandLine,(LPSECURITY_ATTRIBUTES)0x0,
|
|
(LPSECURITY_ATTRIBUTES)0x0,0,0x10,(LPVOID)0x0,&local_438,&local_4a8,
|
|
&local_4e0);
|
|
if (BVar3 == 0) {
|
|
FUN_140010aa0(L"=======Server Fail=======\n",lpCommandLine,uVar8,uVar12);
|
|
FUN_140010aa0(L"Path\t: [%s] \n",&local_438,uVar8,uVar12);
|
|
FUN_140010aa0(L"File\t: [%s] \n",&local_228,uVar8,uVar12);
|
|
}
|
|
else {
|
|
CloseHandle(local_4e0.hThread);
|
|
_ArgList = &local_4e0;
|
|
pcVar11 = FUN_140008c90;
|
|
uVar8 = 0;
|
|
hObject = (HANDLE)_beginthreadex((void *)0x0,0,FUN_140008c90,_ArgList,0,(uint *)&local_4e8);
|
|
CloseHandle(hObject);
|
|
FUN_140010aa0(L"=======ServerOn=======\n",uVar8,pcVar11,_ArgList);
|
|
DVar9 = local_4e0.dwProcessId;
|
|
}
|
|
printf("//////////////////////////////////////////////////////////////////////////\n");
|
|
Sleep(1000);
|
|
return DVar9;
|
|
}
|
|
|