453 lines
15 KiB
C
453 lines
15 KiB
C
/* AgentManager_Release_x64.exe sha256 8fd8ca91725858651a7839d34257b10c2970ac16c97e60c523b8b0c983fcb186
|
|
* Ghidra 12.1.2 decompiler output for 0x140015ac0 FUN_140015ac0
|
|
* Pseudocode, not original source. */
|
|
|
|
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
|
|
|
|
undefined8
|
|
FUN_140015ac0(longlong param_1,uint param_2,undefined8 param_3,uint *param_4,uint *param_5)
|
|
|
|
{
|
|
longlong lVar1;
|
|
BOOL BVar2;
|
|
uint uVar3;
|
|
uint uVar4;
|
|
ulonglong uVar5;
|
|
undefined *puVar6;
|
|
char *pcVar7;
|
|
longlong *plVar8;
|
|
int *piVar9;
|
|
undefined4 extraout_var;
|
|
ulonglong ******ppppppuVar10;
|
|
int *piVar11;
|
|
uint *puVar12;
|
|
undefined *extraout_RAX;
|
|
undefined *extraout_RAX_00;
|
|
undefined *extraout_RAX_01;
|
|
undefined *extraout_RAX_02;
|
|
ulonglong ******_Dst;
|
|
uint *puVar13;
|
|
short *psVar14;
|
|
wchar_t *pwVar15;
|
|
undefined8 uVar16;
|
|
wchar_t *pwVar17;
|
|
uint *puVar18;
|
|
uint uVar19;
|
|
ulonglong uVar20;
|
|
undefined8 *puVar21;
|
|
undefined1 auStackY_678 [32];
|
|
uint *local_628;
|
|
uint local_620 [2];
|
|
undefined *local_618;
|
|
int *local_610;
|
|
undefined1 local_608;
|
|
uint *local_600;
|
|
undefined8 local_5f8;
|
|
_PROCESS_INFORMATION local_5f0;
|
|
_STARTUPINFOW local_5d8;
|
|
ulonglong *****local_568 [2];
|
|
ulonglong ****local_558;
|
|
ulonglong ****local_550;
|
|
undefined8 local_538;
|
|
undefined4 local_530;
|
|
undefined1 local_52c;
|
|
undefined8 local_528;
|
|
undefined8 local_520;
|
|
undefined1 local_518;
|
|
undefined2 local_510;
|
|
undefined6 uStack_50e;
|
|
undefined8 local_500;
|
|
ulonglong local_4f8;
|
|
undefined2 local_4e8;
|
|
undefined6 uStack_4e6;
|
|
undefined8 local_4d8;
|
|
ulonglong local_4d0;
|
|
undefined2 local_4c0;
|
|
undefined6 uStack_4be;
|
|
undefined8 local_4b0;
|
|
ulonglong local_4a8;
|
|
undefined2 local_498;
|
|
undefined6 uStack_496;
|
|
undefined8 local_488;
|
|
ulonglong local_480;
|
|
wchar_t local_468;
|
|
undefined1 local_466 [526];
|
|
wchar_t local_258;
|
|
undefined1 local_256 [526];
|
|
ulonglong local_48;
|
|
|
|
local_5f8 = 0xfffffffffffffffe;
|
|
local_48 = DAT_14016f5a0 ^ (ulonglong)auStackY_678;
|
|
local_600 = param_5;
|
|
if (*(char *)(DAT_14017cf28 + 0x180) == '\0') {
|
|
printf("Not Active Server.!!! \n");
|
|
uVar5 = FUN_140011dd0(param_1 + -8,0,10,0xffffffff);
|
|
return uVar5 & 0xffffffffffffff00;
|
|
}
|
|
pwVar17 = (wchar_t *)0x0;
|
|
puVar13 = param_4;
|
|
if (*(longlong *)(DAT_14017cf38 + 0x58) != 0) {
|
|
for (puVar21 = *(undefined8 **)
|
|
(*(longlong *)(DAT_14017cf38 + 0x38) +
|
|
((ulonglong)(longlong)(int)param_2 % *(ulonglong *)(DAT_14017cf38 + 0x40)) * 8);
|
|
puVar21 != (undefined8 *)0x0; puVar21 = (undefined8 *)*puVar21) {
|
|
if (param_2 == *(uint *)(puVar21 + 1)) {
|
|
if ((puVar21 != (undefined8 *)0x0) && (lVar1 = puVar21[2], lVar1 != 0)) {
|
|
psVar14 = (short *)(lVar1 + 8);
|
|
if (7 < *(ulonglong *)(lVar1 + 0x20)) {
|
|
psVar14 = *(short **)psVar14;
|
|
}
|
|
puVar13 = (uint *)(ulonglong)*param_5;
|
|
FUN_1400124c0(param_1 + -8,psVar14,(ulonglong)*param_4,puVar13);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
local_538 = 0;
|
|
local_530 = 0;
|
|
local_52c = 0;
|
|
local_528 = 0;
|
|
local_520 = 0;
|
|
local_518 = 0;
|
|
local_4f8 = 7;
|
|
local_500 = 0;
|
|
local_510 = 0;
|
|
local_4d0 = 7;
|
|
local_4d8 = 0;
|
|
local_4e8 = 0;
|
|
local_4a8 = 7;
|
|
local_4b0 = 0;
|
|
local_4c0 = 0;
|
|
uVar3 = *param_5;
|
|
if (*(longlong *)(DAT_14017cf20 + 0x58) != 0) {
|
|
for (puVar21 = *(undefined8 **)
|
|
(*(longlong *)(DAT_14017cf20 + 0x38) +
|
|
((ulonglong)(longlong)(int)uVar3 % *(ulonglong *)(DAT_14017cf20 + 0x40)) * 8);
|
|
puVar21 != (undefined8 *)0x0; puVar21 = (undefined8 *)*puVar21) {
|
|
if (uVar3 == *(uint *)(puVar21 + 1)) {
|
|
if (((puVar21 != (undefined8 *)0x0) && (puVar21[2] != 0)) &&
|
|
(*(longlong *)(param_1 + 0x68) != 0)) {
|
|
puVar13 = (uint *)0x0;
|
|
FUN_14000ae50(*(longlong *)(param_1 + 0x68),0,0,0,(longlong)&local_4c0,*param_4,uVar3);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
puVar6 = (undefined *)(longlong)(int)*param_4;
|
|
switch(*param_4) {
|
|
case 4:
|
|
FUN_140034220(DAT_14017cf28);
|
|
pwVar15 = (wchar_t *)(DAT_14017cf28 + 0x30);
|
|
if (7 < *(ulonglong *)(DAT_14017cf28 + 0x48)) {
|
|
pwVar15 = *(wchar_t **)pwVar15;
|
|
}
|
|
puVar6 = (undefined *)FUN_14003a250(DAT_14017cf20,pwVar15);
|
|
if ((char)puVar6 == '\0') {
|
|
local_258 = L'\0';
|
|
memset(local_256,0,0x206);
|
|
local_468 = L'\0';
|
|
memset(local_466,0,0x206);
|
|
for (pcVar7 = *(char **)(DAT_14017cf50 + 8); pcVar7 != *(char **)(DAT_14017cf50 + 0x10);
|
|
pcVar7 = pcVar7 + 0x30) {
|
|
if (*pcVar7 == '\x18') {
|
|
pwVar17 = (wchar_t *)(pcVar7 + 8);
|
|
if (7 < *(ulonglong *)(pcVar7 + 0x20)) {
|
|
pwVar17 = *(wchar_t **)pwVar17;
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
uVar16 = 0x104;
|
|
wcscpy_s(&local_258,0x104,pwVar17);
|
|
plVar8 = FUN_14003e430((longlong *)&local_618,uVar16,pwVar17,puVar13);
|
|
pwVar17 = (wchar_t *)*plVar8;
|
|
if ((wchar_t *)*plVar8 == (wchar_t *)0x0) {
|
|
pwVar17 = (wchar_t *)PTR_DAT_14016f010;
|
|
}
|
|
uVar16 = 0x104;
|
|
pwVar15 = &local_468;
|
|
wcscpy_s(pwVar15,0x104,pwVar17);
|
|
if (((local_618 != (undefined *)0x0) && (local_618 != PTR_DAT_14016f010)) &&
|
|
(local_618 + -8 != (undefined *)0x0)) {
|
|
piVar9 = (int *)FUN_14003e7c0(pwVar15,uVar16,pwVar17,puVar13);
|
|
local_610 = piVar9;
|
|
FUN_14003d040(piVar9);
|
|
local_608 = 1;
|
|
piVar11 = (int *)(local_618 + -4);
|
|
*piVar11 = *piVar11 + -1;
|
|
if (*piVar11 == 0) {
|
|
FUN_14003e8b0(local_618 + -8);
|
|
}
|
|
FUN_14003d0d0((longlong)piVar9);
|
|
}
|
|
uVar5 = 0;
|
|
local_618 = PTR_DAT_14016f010;
|
|
memset(&local_5d8,0,0x68);
|
|
local_5d8.cb = 0x68;
|
|
local_5d8.dwFlags = 0x13;
|
|
local_5d8.dwXSize = 700;
|
|
local_5d8.dwYSize = 0x6e;
|
|
local_5d8.dwFillAttribute = 0x17;
|
|
local_5d8.wShowWindow = 5;
|
|
puVar13 = (uint *)0x0;
|
|
BVar2 = CreateProcessW((LPCWSTR)0x0,&local_258,(LPSECURITY_ATTRIBUTES)0x0,
|
|
(LPSECURITY_ATTRIBUTES)0x0,0,0x10,(LPVOID)0x0,&local_468,&local_5d8,
|
|
&local_5f0);
|
|
if (BVar2 == 0) {
|
|
local_550 = (ulonglong ****)0x7;
|
|
local_558 = (ulonglong ****)0x0;
|
|
local_568[0] = (ulonglong *****)((ulonglong)local_568[0] & 0xffffffffffff0000);
|
|
puVar21 = (undefined8 *)(DAT_14017cf28 + 0x30);
|
|
if (7 < *(ulonglong *)(DAT_14017cf28 + 0x48)) {
|
|
puVar21 = (undefined8 *)*puVar21;
|
|
}
|
|
pwVar17 = L"FAILED PATCH ON %s";
|
|
_Dst = (ulonglong ******)&local_498;
|
|
ppppppuVar10 = (ulonglong ******)
|
|
FUN_1400ed6f0((ulonglong *)_Dst,L"FAILED PATCH ON %s",puVar21,puVar13);
|
|
if (local_568 != ppppppuVar10) {
|
|
if ((ulonglong *****)0x7 < local_550) {
|
|
_Dst = (ulonglong ******)local_568[0];
|
|
operator_delete(local_568[0]);
|
|
}
|
|
local_550 = (ulonglong ****)0x7;
|
|
local_558 = (ulonglong ****)0x0;
|
|
local_568[0] = (ulonglong *****)((ulonglong)local_568[0] & 0xffffffffffff0000);
|
|
if (ppppppuVar10[3] < (ulonglong *****)0x8) {
|
|
puVar21 = (undefined8 *)(((longlong)ppppppuVar10[2] + 1U) * 2);
|
|
_Dst = local_568;
|
|
pwVar17 = (wchar_t *)ppppppuVar10;
|
|
memmove(_Dst,ppppppuVar10,(size_t)puVar21);
|
|
}
|
|
else {
|
|
local_568[0] = *ppppppuVar10;
|
|
*ppppppuVar10 = (ulonglong *****)0x0;
|
|
}
|
|
local_558 = (ulonglong ****)ppppppuVar10[2];
|
|
local_550 = (ulonglong ****)ppppppuVar10[3];
|
|
ppppppuVar10[3] = (ulonglong *****)0x7;
|
|
ppppppuVar10[2] = (ulonglong *****)0x0;
|
|
*(wchar_t *)ppppppuVar10 = L'\0';
|
|
}
|
|
if (7 < local_480) {
|
|
_Dst = (ulonglong ******)CONCAT62(uStack_496,local_498);
|
|
operator_delete(_Dst);
|
|
}
|
|
local_480 = 7;
|
|
local_488 = 0;
|
|
local_498 = 0;
|
|
ppppppuVar10 = local_568;
|
|
if ((ulonglong *****)0x7 < local_550) {
|
|
ppppppuVar10 = (ulonglong ******)local_568[0];
|
|
}
|
|
FUN_14003e7c0(_Dst,pwVar17,puVar21,puVar13);
|
|
local_628 = (uint *)PTR_DAT_14016f010;
|
|
uVar3 = FUN_14003e620((short *)ppppppuVar10);
|
|
if ((local_628 != (uint *)0x0) && (local_628 != (uint *)PTR_DAT_14016f010)) {
|
|
uVar5 = (ulonglong)local_628[-2];
|
|
}
|
|
uVar4 = uVar3;
|
|
if ((((int)uVar3 <= (int)uVar5) && (uVar4 = 0, local_628 != (uint *)0x0)) &&
|
|
(local_628 != (uint *)PTR_DAT_14016f010)) {
|
|
uVar4 = local_628[-2];
|
|
}
|
|
uVar19 = 1;
|
|
if (1 < (int)uVar4) {
|
|
uVar19 = uVar4;
|
|
}
|
|
uVar20 = (ulonglong)uVar19;
|
|
if (local_628 == (uint *)0x0) {
|
|
uVar4 = 0;
|
|
}
|
|
else if (local_628 == (uint *)PTR_DAT_14016f010) {
|
|
uVar4 = 0;
|
|
}
|
|
else {
|
|
uVar4 = local_628[-2];
|
|
}
|
|
if ((int)uVar4 < (int)uVar19) {
|
|
puVar12 = local_628;
|
|
if (local_628 == (uint *)0x0) {
|
|
puVar12 = (uint *)PTR_DAT_14016f010;
|
|
}
|
|
local_628 = puVar12;
|
|
if ((int)uVar19 < 0) {
|
|
/* WARNING: Subroutine does not return */
|
|
FUN_14003dec0();
|
|
}
|
|
if (uVar19 == 0) {
|
|
local_628 = (uint *)PTR_DAT_14016f010;
|
|
if (((puVar12 != (uint *)0x0) && (puVar12 != (uint *)PTR_DAT_14016f010)) &&
|
|
(puVar12 + -2 != (uint *)0x0)) {
|
|
local_628 = puVar12;
|
|
piVar11 = (int *)FUN_14003e7c0(puVar12,PTR_DAT_14016f010,uVar5,puVar13);
|
|
local_610 = piVar11;
|
|
FUN_14003d040(piVar11);
|
|
local_608 = 1;
|
|
puVar13 = puVar12 + -1;
|
|
*puVar13 = *puVar13 - 1;
|
|
if (*puVar13 == 0) {
|
|
FUN_14003e8b0(puVar12 + -2);
|
|
}
|
|
FUN_14003d0d0((longlong)piVar11);
|
|
local_628 = (uint *)PTR_DAT_14016f010;
|
|
}
|
|
}
|
|
else {
|
|
if (puVar12 == (uint *)0x0) {
|
|
uVar4 = 0;
|
|
}
|
|
else if (puVar12 == (uint *)PTR_DAT_14016f010) {
|
|
uVar4 = 0;
|
|
}
|
|
else {
|
|
uVar4 = puVar12[-2];
|
|
}
|
|
if (uVar19 != uVar4) {
|
|
puVar12 = (uint *)FUN_14003e840((longlong)(int)uVar19 * 2 + 10);
|
|
if (puVar12 != (uint *)0x0) {
|
|
*puVar12 = 0;
|
|
puVar12[1] = 1;
|
|
}
|
|
*puVar12 = uVar19;
|
|
if (local_628 == (uint *)0x0) {
|
|
uVar4 = 0;
|
|
}
|
|
else if (local_628 == (uint *)PTR_DAT_14016f010) {
|
|
uVar4 = 0;
|
|
}
|
|
else {
|
|
uVar4 = local_628[-2];
|
|
}
|
|
puVar18 = (uint *)PTR_DAT_14016f010;
|
|
if ((int)uVar19 < (int)uVar4) {
|
|
LAB_1400160ca:
|
|
if (local_628 != (uint *)0x0) {
|
|
puVar18 = local_628;
|
|
}
|
|
}
|
|
else {
|
|
if (local_628 != (uint *)0x0) {
|
|
if (local_628 == (uint *)PTR_DAT_14016f010) {
|
|
uVar20 = 0;
|
|
}
|
|
else {
|
|
uVar20 = (ulonglong)local_628[-2];
|
|
}
|
|
goto LAB_1400160ca;
|
|
}
|
|
uVar20 = 0;
|
|
}
|
|
FUN_14003e650(puVar12 + 2,puVar18,(int)uVar20);
|
|
FUN_140002190((longlong *)&local_628,puVar18,uVar20,puVar13);
|
|
local_628 = puVar12 + 2;
|
|
}
|
|
}
|
|
}
|
|
FUN_140001df0((longlong *)&local_628);
|
|
puVar13 = local_628;
|
|
if (local_628 == (uint *)0x0) {
|
|
puVar13 = (uint *)PTR_DAT_14016f010;
|
|
}
|
|
FUN_14003e650(puVar13,ppppppuVar10,uVar3);
|
|
puVar13 = local_628;
|
|
if (local_628 == (uint *)0x0) {
|
|
puVar13 = (uint *)PTR_DAT_14016f010;
|
|
}
|
|
uVar4 = FUN_14003e620((short *)puVar13);
|
|
uVar19 = 0;
|
|
uVar3 = 0;
|
|
if (0 < (int)uVar4) {
|
|
uVar3 = uVar4;
|
|
}
|
|
uVar4 = uVar19;
|
|
if ((local_628 != (uint *)0x0) && (local_628 != (uint *)PTR_DAT_14016f010)) {
|
|
uVar4 = local_628[-2];
|
|
}
|
|
if (((int)uVar3 < (int)uVar4) || (uVar3 = uVar19, local_628 == (uint *)0x0)) {
|
|
LAB_140016161:
|
|
if (((local_628 != (uint *)PTR_DAT_14016f010) && (local_628 != (uint *)0x0)) &&
|
|
(local_628 + -2 != (uint *)0x0)) {
|
|
local_628[-2] = uVar3;
|
|
*(undefined2 *)((longlong)local_628 + (longlong)(int)uVar3 * 2) = 0;
|
|
}
|
|
}
|
|
else if (local_628 != (uint *)PTR_DAT_14016f010) {
|
|
uVar3 = local_628[-2];
|
|
goto LAB_140016161;
|
|
}
|
|
local_620[0] = 2;
|
|
plVar8 = (longlong *)(param_1 + 0x40);
|
|
puVar13 = local_620;
|
|
puVar6 = &DAT_14016f5d0;
|
|
uVar5 = (ulonglong)param_2;
|
|
(**(code **)(*plVar8 + 0xd0))();
|
|
puVar12 = local_628;
|
|
if (((local_628 != (uint *)0x0) && (local_628 != (uint *)PTR_DAT_14016f010)) &&
|
|
(puVar18 = local_628 + -2, puVar18 != (uint *)0x0)) {
|
|
piVar11 = (int *)FUN_14003e7c0(plVar8,uVar5,puVar6,puVar13);
|
|
local_610 = piVar11;
|
|
FUN_14003d040(piVar11);
|
|
local_608 = 1;
|
|
puVar12 = puVar12 + -1;
|
|
*puVar12 = *puVar12 - 1;
|
|
if (*puVar12 == 0) {
|
|
FUN_14003e8b0(puVar18);
|
|
}
|
|
FUN_14003d0d0((longlong)piVar11);
|
|
}
|
|
local_628 = (uint *)PTR_DAT_14016f010;
|
|
puVar6 = PTR_DAT_14016f010;
|
|
param_5 = local_600;
|
|
if ((ulonglong *****)0x7 < local_550) {
|
|
operator_delete(local_568[0]);
|
|
puVar6 = extraout_RAX;
|
|
param_5 = local_600;
|
|
}
|
|
}
|
|
else {
|
|
BVar2 = CloseHandle(local_5f0.hThread);
|
|
puVar6 = (undefined *)CONCAT44(extraout_var,BVar2);
|
|
}
|
|
}
|
|
case 0:
|
|
case 1:
|
|
case 2:
|
|
case 3:
|
|
case 5:
|
|
case 6:
|
|
case 7:
|
|
case 0xd:
|
|
if (*(longlong *)(param_1 + 0x70) != 0) {
|
|
puVar6 = (undefined *)
|
|
FUN_14000cb70(*(longlong *)(param_1 + 0x70),*param_4,(ulonglong)*param_5,
|
|
(longlong)puVar13);
|
|
}
|
|
break;
|
|
case 0xc:
|
|
puVar6 = *(undefined **)(param_1 + 0x70);
|
|
puVar6[0x9c] = 1;
|
|
}
|
|
if (7 < local_4a8) {
|
|
operator_delete((void *)CONCAT62(uStack_4be,local_4c0));
|
|
puVar6 = extraout_RAX_00;
|
|
}
|
|
local_4a8 = 7;
|
|
local_4b0 = 0;
|
|
local_4c0 = 0;
|
|
if (7 < local_4d0) {
|
|
operator_delete((void *)CONCAT62(uStack_4e6,local_4e8));
|
|
puVar6 = extraout_RAX_01;
|
|
}
|
|
local_4d0 = 7;
|
|
local_4d8 = 0;
|
|
local_4e8 = 0;
|
|
if (7 < local_4f8) {
|
|
operator_delete((void *)CONCAT62(uStack_50e,local_510));
|
|
puVar6 = extraout_RAX_02;
|
|
}
|
|
return CONCAT71((int7)((ulonglong)puVar6 >> 8),1);
|
|
}
|
|
|