NtAlpcQueryInformationMessage

NTSTATUS __stdcall NtAlpcQueryInformationMessage(_HANDLE Handle, _SIZE_T Length, INT64 a3){
  _LUID *v3; 
  _LUID *v4; 
  int v5; 
  VOID *v6; 
  _ETHREAD *CurrentThread; 
  char PreviousMode; 
  UINT64 *v9; 
  __int64 v10; 
  unsigned int v11; 
  int v12; 
  _KALPC_MESSAGE **v13; 
  _ADAPTER_OBJECT *v14; 
  _KALPC_MESSAGE *v15; 
  int v16; 
  int v17; 
  NTSTATUS TokenModifiedIdMessage; 
  UINT64 MessageId; 
  PVOID Object; 
  _KALPC_MESSAGE *Message; 
  unsigned int Lengtha; 
  UINT64 *ReturnLength; 

  v4 = v3;
  v5 = a3;
  v6 = *(VOID **)&Handle;
  Message = 0i64;
  MessageId = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  AlpcpCaptureIdMessage(*(PORT_MESSAGE **)&Length, &MessageId, (UINT64 *)((char *)&MessageId + 4));
  if( PreviousMode )
  {
    ProbeForWrite((UINT64)v4, Lengtha, 4i64);
    v9 = ReturnLength;
    if( ReturnLength )
    {
      v10 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v10 = (__int64)ReturnLength;
      *(_DWORD *)v10 = *(_DWORD *)v10;
    }
  }
  else
  {
    v9 = ReturnLength;
  }
  v11 = MessageId;
  if( !(_DWORD)MessageId )
  {
    v12 = -1073741811;
    goto LABEL_20;
  }
  Object = 0i64;
  v12 = ObReferenceObjectByHandle(v6, 0x20000ui64, AlpcPortObjectType, PreviousMode, &Object, 0i64);
  if( v12 >= 0 )
  {
    v14 = (_ADAPTER_OBJECT *)Object;
    v12 = AlpcpLookupMessage((_ALPC_PORT *)Object, v11, HIDWORD(MessageId), v13);
    if( v12 < 0 )
    {
LABEL_19:
      HalPutDmaAdapter(v14);
      goto LABEL_20;
    }
    v15 = Message;
    if( !Message->OwnerPort )
    {
      v12 = -1073740029;
      goto LABEL_18;
    }
    if( v5 )
    {
      v16 = v5 - 1;
      if( !v16 )
      {
        TokenModifiedIdMessage = AlpcpQueryTokenModifiedIdMessage((_ALPC_PORT *)v14, Message, v4, Lengtha, v9);
        goto LABEL_17;
      }
      v17 = v16 - 1;
      if( v17 )
      {
        if( v17 == 1 )
        {
          TokenModifiedIdMessage = AlpcpQueryHandleInformationMessage((_ALPC_PORT *)v14, Message, v4, Lengtha, v9);
LABEL_17:
          v12 = TokenModifiedIdMessage;
LABEL_18:
          AlpcpUnlockMessage(v15);
          goto LABEL_19;
        }
      }
      else if( !v4 && !Lengtha && !v9 )
      {
        v12 = (Message->u1.State & 7) != 4 ? 0x103 : 0;
        goto LABEL_18;
      }
      v12 = -1073741811;
      goto LABEL_18;
    }
    TokenModifiedIdMessage = AlpcpQuerySidMessage((_ALPC_PORT *)v14, Message, v4, Lengtha, v9);
    goto LABEL_17;
  }
LABEL_20:
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return v12;
}

Referenced by: