83 lines
2.7 KiB
C
83 lines
2.7 KiB
C
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
|
|
* Ghidra 12.1.2 pseudocode via REA, ev_ad71d730ad826f5e73d5b5ec119273acf91c525002d977f0d017bc11eb2cfbb4
|
|
* Decompiler output, not original source. */
|
|
|
|
undefined8 FUN_140008c90(undefined8 *param_1)
|
|
|
|
{
|
|
DWORD DVar1;
|
|
HANDLE hProcess;
|
|
undefined4 *puVar2;
|
|
undefined8 *puVar3;
|
|
longlong lVar4;
|
|
longlong lVar5;
|
|
uint *puVar6;
|
|
undefined *puVar7;
|
|
uint *puVar8;
|
|
uint local_res8 [2];
|
|
DWORD local_res10 [2];
|
|
undefined8 *local_res18;
|
|
undefined8 *local_res20;
|
|
undefined8 local_118;
|
|
undefined8 local_110;
|
|
undefined8 local_108;
|
|
undefined8 local_100;
|
|
undefined8 local_f8;
|
|
undefined8 local_f0 [4];
|
|
undefined4 local_d0 [44];
|
|
|
|
local_f8 = 0xfffffffffffffffe;
|
|
hProcess = (HANDLE)*param_1;
|
|
DVar1 = *(DWORD *)(param_1 + 2);
|
|
local_res10[0] = DVar1;
|
|
do {
|
|
Sleep(10);
|
|
GetExitCodeProcess(hProcess,local_res10);
|
|
} while (local_res10[0] == 0x103);
|
|
puVar2 = (undefined4 *)FUN_14002c9a0(DAT_140162d60,DVar1);
|
|
if (puVar2 == (undefined4 *)0x0) {
|
|
wprintf(L"NOT FIND PROCESS ID \n");
|
|
}
|
|
else {
|
|
lVar5 = *(longlong *)(DAT_1401626f8 + 0xa8);
|
|
if (lVar5 != 0) {
|
|
puVar2[0x28] = 0;
|
|
puVar2[0x31] = 0;
|
|
local_res18 = local_f0;
|
|
puVar3 = FUN_140006c30((longlong)puVar2,local_f0);
|
|
local_118 = *(undefined8 *)(puVar2 + 0x2e);
|
|
local_110 = *(undefined8 *)(puVar2 + 0x30);
|
|
local_108 = *(undefined8 *)(puVar2 + 0x32);
|
|
local_100 = *(undefined8 *)(puVar2 + 0x34);
|
|
local_res8[0] = puVar2[1];
|
|
local_res20 = puVar3;
|
|
lVar4 = FUN_140007fa0(lVar5);
|
|
(**(code **)(*(longlong *)(lVar4 + 0x68) + 0x40))
|
|
((longlong *)(lVar4 + 0x68),1,&DAT_1401555d0,local_res8,&local_118,puVar3);
|
|
if ((void *)*puVar3 != (void *)0x0) {
|
|
operator_delete((void *)*puVar3);
|
|
}
|
|
*puVar3 = 0;
|
|
puVar3[1] = 0;
|
|
puVar3[2] = 0;
|
|
local_res20 = (undefined8 *)CONCAT44(local_res20._4_4_,1);
|
|
local_res18 = (undefined8 *)CONCAT44(local_res18._4_4_,puVar2[1]);
|
|
local_res8[0] = CONCAT31(local_res8[0]._1_3_,1);
|
|
lVar5 = FUN_140007fa0(lVar5);
|
|
puVar8 = local_res8;
|
|
puVar7 = &DAT_1401555d0;
|
|
(**(code **)(*(longlong *)(lVar5 + 0x68) + 0x50))
|
|
((longlong *)(lVar5 + 0x68),1,&DAT_1401555d0,puVar8,&local_res20,&local_res18);
|
|
if ((*(char *)((longlong)puVar2 + 0xd5) != '\0') || (*(char *)(DAT_140162d68 + 0x171) != '\0')
|
|
) {
|
|
puVar6 = FUN_14000b8e0(puVar2,local_d0);
|
|
FUN_140008ea0(DAT_140162d78,puVar6,puVar7,puVar8);
|
|
if ((*(char *)(puVar2 + 3) == '\x01') && (0 < (int)puVar2[0x34])) {
|
|
FUN_140009f20(DAT_140162d78,puVar2[1]);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|