44 lines
1.4 KiB
C
44 lines
1.4 KiB
C
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
|
|
* Ghidra 12.1.2 pseudocode via REA, ev_ad71d730ad826f5e73d5b5ec119273acf91c525002d977f0d017bc11eb2cfbb4
|
|
* Decompiler output, not original source. */
|
|
|
|
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
|
|
|
|
ulonglong FUN_140009780(wchar_t *param_1)
|
|
|
|
{
|
|
int iVar1;
|
|
BOOL BVar2;
|
|
HANDLE hObject;
|
|
HANDLE hProcess;
|
|
undefined4 extraout_var;
|
|
undefined4 extraout_var_00;
|
|
undefined1 auStack_278 [32];
|
|
undefined4 local_258 [2];
|
|
DWORD local_250;
|
|
wchar_t local_22c [266];
|
|
ulonglong local_18;
|
|
|
|
local_18 = DAT_1401555a0 ^ (ulonglong)auStack_278;
|
|
if (param_1 != (wchar_t *)0x0) {
|
|
hObject = (HANDLE)CreateToolhelp32Snapshot(2);
|
|
memset(local_258,0,0x238);
|
|
local_258[0] = 0x238;
|
|
iVar1 = Process32FirstW(hObject,local_258);
|
|
while (iVar1 != 0) {
|
|
iVar1 = _wcsicmp(param_1,local_22c);
|
|
if ((iVar1 == 0) &&
|
|
(hProcess = OpenProcess(1,0,local_250), hProcess != (HANDLE)0xffffffffffffffff)) {
|
|
wprintf(L"Process Kill.!!! [%s] \n");
|
|
TerminateProcess(hProcess,0);
|
|
BVar2 = CloseHandle(hProcess);
|
|
return CONCAT71((int7)(CONCAT44(extraout_var_00,BVar2) >> 8),1);
|
|
}
|
|
iVar1 = Process32NextW(hObject,local_258);
|
|
}
|
|
BVar2 = CloseHandle(hObject);
|
|
local_18 = CONCAT44(extraout_var,BVar2);
|
|
}
|
|
return local_18 & 0xffffffffffffff00;
|
|
}
|
|
|