CmpAddStringToMapping
INT64 __stdcall CmpAddStringToMapping(UNICODE_STRING *String, CMHIVE *CmHive){
unsigned int v4;
char *v5;
__int64 v6;
VOID **v7;
int v8;
char *v9;
__int64 v10;
PVOID v12;
VOID **PoolWithTag;
v4 = 0;
ExAcquireFastMutex((PFAST_MUTEX)((char *)&CmpDummyThreadEvent + 736));
if( CmpSIDToHiveMappingCount == -1 )
{
v4 = -1073741675;
goto LABEL_5;
}
if( CmpSIDToHiveMappingCount + 1 >= (unsigned int)CmpSIDToHiveMappingSize )
{
v12 = CmpSIDToHiveMapping;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 32i64 * (unsigned int)(CmpSIDToHiveMappingSize + 4), 1700154691i64);
CmpSIDToHiveMapping = PoolWithTag;
if( !PoolWithTag )
{
CmpSIDToHiveMapping = v12;
goto LABEL_11;
}
CmpSIDToHiveMappingSize += 4;
if( v12 )
{
memmove(PoolWithTag, v12, 32 * CmpSIDToHiveMappingCount);
ExFreePoolWithTag(v12, 0x65564D43u);
}
}
v5 = (char *)CmpSIDToHiveMapping;
v6 = 32i64 * (unsigned int)CmpSIDToHiveMappingCount;
*(_QWORD *)((char *)CmpSIDToHiveMapping + v6 + 24) = CmHive;
*(_WORD *)&v5[v6] = String->Length;
*(_WORD *)&v5[v6 + 2] = String->Length;
v7 = ExAllocatePoolWithTag(1ui64, String->Length, 1700154691i64);
v8 = CmpSIDToHiveMappingCount;
v9 = (char *)CmpSIDToHiveMapping;
v10 = 32i64 * (unsigned int)CmpSIDToHiveMappingCount;
*(_QWORD *)((char *)CmpSIDToHiveMapping + v10 + 8) = v7;
if( !v7 )
{
LABEL_11:
v4 = -1073741670;
goto LABEL_5;
}
memmove(v7, String->Buffer, String->Length);
*(_DWORD *)&v9[v10 + 16] = CmpHashUnicodeComponent(String);
CmpSIDToHiveMappingCount = v8 + 1;
LABEL_5:
KeReleaseGuardedMutex((PKGUARDED_MUTEX)((char *)&CmpDummyThreadEvent + 736));
return v4;
}Referenced by:
CmpVEAddHiveToSIDMappingTable