PspApplyMitigationOptions
VOID __fastcall PspApplyMitigationOptions(_EPROCESS *Process, INT64 a2, __m128i *a3, INT64 a4, INT64 a5){
_EWOW64PROCESS *WoW64Process;
__int64 v7;
unsigned __int64 v9;
__m128i v11;
__int128 v12;
unsigned __int64 v13;
bool v14;
_HANDLE_TABLE *v15;
unsigned int v16;
unsigned int v17;
unsigned __int64 v18;
unsigned __int8 v19;
int v20;
_EWOW64PROCESS *v21;
char v22;
INT64 v23;
int v24;
unsigned __int64 v25;
char v26;
__int64 v27;
UINT64 MitigationOptions[2];
__int64 v29;
__m128i v30;
unsigned __int64 v31;
__int128 v32;
unsigned __int64 v33;
WoW64Process = Process->WoW64Process;
v7 = a3[1].m128i_i64[0];
v9 = *(_QWORD *)(a4 + 16);
v31 = v7;
v33 = v9;
v11 = *a3;
v12 = *(_OWORD *)a4;
v30 = *a3;
v32 = v12;
if( WoW64Process && WoW64Process->Machine == 332 )
{
*(__m128i *)MitigationOptions = v11;
v29 = v7;
Process->Pcb.Flags._bf_0 = PspDecodeMitigationExecuteOptions((UINT64)MitigationOptions);
}
v13 = v30.m128i_i64[0];
if( (((unsigned __int64)v30.m128i_i64[0] >> 8) & 3) != 1 )
{
if( (((unsigned __int64)v30.m128i_i64[0] >> 8) & 3) != 3 )
goto LABEL_8;
_InterlockedOr((volatile signed __int32 *)&Process->2512, 8u);
}
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x10u);
v13 = v30.m128i_i64[0];
LABEL_8:
if( (v13 & 0x30000) != 0 )
v14 = (BYTE2(v13) & 3) == 2;
else
v14 = (a5 & 1) == 0;
if( v14 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x40u);
v13 = v30.m128i_i64[0];
}
if( (Process->MitigationFlags & 0x40) == 0 )
{
if( ((v13 >> 20) & 3) != 0 )
{
if( ((v13 >> 20) & 3) != 1 )
goto LABEL_19;
}
else if( (a5 & 2) == 0 )
{
goto LABEL_19;
}
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x20u);
v13 = v30.m128i_i64[0];
}
LABEL_19:
if( !a2 )
goto LABEL_28;
if( ((v13 >> 24) & 3) == 0 )
{
if( (a5 & 4) == 0 )
goto LABEL_26;
LABEL_24:
v15 = ObReferenceProcessHandleTable(Process);
if( v15 )
{
ExEnableHandleExceptions(v15, 1u);
ExReleaseRundownProtection(&Process->RundownProtect);
}
goto LABEL_26;
}
if( ((v13 >> 24) & 3) == 1 )
goto LABEL_24;
LABEL_26:
if( (*(_DWORD *)(a2 + 2512) & 0x1000) != 0 )
{
v13 = v13 & 0xFFFFFFFFCFFFFFFFui64 | 0x10000000;
v30.m128i_i64[0] = v13;
}
LABEL_28:
if( ((v13 >> 28) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x3000u);
v13 = v30.m128i_i64[0];
}
v16 = 0x2000;
if( (Process->MitigationFlags & 0x1000) == 0 && (((unsigned __int64)v32 >> 28) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x2000u);
v13 = v30.m128i_i64[0];
}
if( ((v13 >> 36) & 3) != 1 )
{
if( ((v13 >> 36) & 3) != 3 )
goto LABEL_37;
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x200u);
}
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x900u);
v13 = v30.m128i_i64[0];
LABEL_37:
v17 = 1024;
v30.m128i_i64[1] = _mm_srli_si128(_mm_loadu_si128(&v30), 8).m128i_u64[0];
if( (v30.m128i_i8[15] & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x400u);
v13 = v30.m128i_i64[0];
}
if( (Process->MitigationFlags & 0x100) != 0 )
{
v30.m128i_i64[1] = v30.m128i_i64[1] & 0xFFFFFFFFFCCCFFFFui64 | 0x2220000;
*((_QWORD *)&v32 + 1) = *((_QWORD *)&v32 + 1) & 0xFFFFFFFFFCCCFFFFui64 | 0x2220000;
}
else if( (((unsigned __int64)v32 >> 36) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x800u);
v13 = v30.m128i_i64[0];
}
if( (BYTE4(v13) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x80u);
v13 = v30.m128i_i64[0];
}
switch( (v13 >> 40) & 3 )
{
case 0ui64:
if( (a5 & 8) == 0 )
break;
v18 = v13 & 0xFFFFFCFFFFFFFFFFui64 | 0x10000000000i64;
v30.m128i_i64[0] = v18;
if( (a5 & 0x20) != 0 && !PspDisableControlFlowGuardExportSuppression )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 2u);
v30.m128i_i64[0] = v18 | 0x30000000000i64;
}
LABEL_57:
_InterlockedOr((volatile signed __int32 *)&Process->2512, 1u);
if( (a5 & 0x10) == 0 )
_interlockedbittestandset(&Process->Pcb.ProcessFlags, 5u);
goto LABEL_59;
case 1ui64:
goto LABEL_57;
case 3ui64:
if( PspDisableControlFlowGuardExportSuppression )
{
v30.m128i_i64[0] = v13 & 0xFFFFFCFFFFFFFFFFui64 | 0x10000000000i64;
}
else
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 2u);
v30.m128i_i64[0] |= 0x30000000000ui64;
}
_InterlockedOr((volatile signed __int32 *)&Process->2512, 1u);
if( (a5 & 0x10) == 0 )
KeSetCheckStackExtentsProcess(&Process->Pcb, 1ui64);
LABEL_59:
v13 = v30.m128i_i64[0];
break;
}
if( (((unsigned __int64)v30.m128i_i64[1] >> 8) & 3) == 1 && (Process->MitigationFlags & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 4u);
v13 = v30.m128i_i64[0];
}
if( ((v13 >> 44) & 3) == 1 )
{
if( Process->SignatureLevel < 8u )
Process->SignatureLevel = 8;
if( Process->SectionSignatureLevel < 8u )
Process->SectionSignatureLevel = 8;
}
else
{
if( ((v13 >> 44) & 3) != 3 )
goto LABEL_74;
if( Process->SignatureLevel < 6u )
Process->SignatureLevel = 6;
if( Process->SectionSignatureLevel < 6u )
Process->SectionSignatureLevel = 6;
}
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x800000u);
v13 = v30.m128i_i64[0];
LABEL_74:
if( (Process->MitigationFlags & 0x800000) == 0 )
{
if( (((unsigned __int64)v32 >> 44) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x1000000u);
goto LABEL_79;
}
if( (((unsigned __int64)v32 >> 44) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x2000000u);
LABEL_79:
v13 = v30.m128i_i64[0];
}
}
v19 = v30.m128i_i8[0];
if( (((unsigned __int8)v30.m128i_i8[0] >> 4) & 3) == 0 && (Process->MitigationFlags & 1) != 0 )
{
v13 = v13 & 0xFFFFFFFFFFFFFFCFui64 | 0x10;
v30.m128i_i64[0] = v13;
v19 = v13;
}
if( ((v19 >> 4) & 3) != 1 && (((unsigned __int64)v32 >> 4) & 3) == 1 )
{
v13 |= 0x30ui64;
v30.m128i_i64[0] = v13;
}
if( (a5 & 0x30000) == 0x10000 )
{
v13 = v13 & 0xFFFCFFFFFFFFFFFFui64 | 0x1000000000000i64;
LABEL_91:
v30.m128i_i64[0] = v13;
goto LABEL_92;
}
if( (a5 & 0x30000) == 196608 && (BYTE6(v13) & 3) != 1 )
{
v13 |= 0x3000000000000ui64;
goto LABEL_91;
}
LABEL_92:
if( (HIWORD(v13) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x10000u);
goto LABEL_96;
}
if( (HIWORD(v13) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x20000u);
LABEL_96:
v13 = v30.m128i_i64[0];
}
if( (Process->MitigationFlags & 0x30000) == 0 && (WORD3(v32) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x20000u);
v13 = v30.m128i_i64[0];
}
if( a2 && (*(_DWORD *)(a2 + 2512) & 0x80000) != 0 )
{
v13 = v13 & 0xFFCFFFFFFFFFFFFFui64 | 0x10000000000000i64;
v30.m128i_i64[0] = v13;
}
if( ((v13 >> 52) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x80000u);
v13 = v30.m128i_i64[0];
}
if( (Process->MitigationFlags & 0x80000) == 0 && (((unsigned __int64)v32 >> 52) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x100000u);
v13 = v30.m128i_i64[0];
}
if( a2 && (*(_DWORD *)(a2 + 2512) & 0x200000) != 0 )
{
v13 = v13 & 0xFCFFFFFFFFFFFFFFui64 | 0x100000000000000i64;
v30.m128i_i64[0] = v13;
}
if( (HIBYTE(v13) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x200000u);
v13 = v30.m128i_i64[0];
}
if( (Process->MitigationFlags & 0x200000) == 0 && (BYTE7(v32) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x400000u);
v13 = v30.m128i_i64[0];
}
if( a2 && (*(_DWORD *)(a2 + 2512) & 0x40000) != 0 )
{
v13 = v13 & 0xCFFFFFFFFFFFFFFFui64 | 0x1000000000000000i64;
v30.m128i_i64[0] = v13;
}
if( ((v13 >> 60) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x40000u);
if( a2 )
{
v20 = *(_DWORD *)(a2 + 2512);
if( (v20 & 0x4000000) != 0 )
{
v30.m128i_i64[1] = v30.m128i_i64[1] & 0xFFFFFFFFFFFFFFCFui64 | 0x10;
}
else if( (v20 & 0x8000000) != 0 )
{
v30.m128i_i64[1] |= 0x30ui64;
}
}
if( (((unsigned __int64)v30.m128i_i64[1] >> 4) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0xC000000u);
}
else if( (((unsigned __int64)v30.m128i_i64[1] >> 4) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x8000000u);
}
if( (Process->MitigationFlags & 0xC000000) == 0 && ((*((_QWORD *)&v32 + 1) >> 4) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x8000000u);
if( (((unsigned __int64)v30.m128i_i64[1] >> 28) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 1u);
if( (Process->MitigationFlags2 & 1) == 0 && ((*((_QWORD *)&v32 + 1) >> 28) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 2u);
if( (v30.m128i_i8[12] & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 4u);
if( (HIWORD(v30.m128i_i64[1]) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x40000000u);
if( (((unsigned __int64)v30.m128i_i64[1] >> 52) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, v16);
if( (Process->MitigationFlags2 & 4) == 0 && (BYTE12(v32) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 8u);
if( (((unsigned __int64)v30.m128i_i64[1] >> 40) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, v17);
if( (v17 & Process->MitigationFlags2) == 0 && ((*((_QWORD *)&v32 + 1) >> 40) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x800u);
if( (((unsigned __int64)v30.m128i_i64[1] >> 16) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x10u);
if( (Process->MitigationFlags2 & 0x10) == 0 && ((*((_QWORD *)&v32 + 1) >> 16) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x20u);
v21 = Process->WoW64Process;
if( v21 && v21->Machine == 332 )
{
if( (((unsigned __int64)v30.m128i_i64[1] >> 20) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x40u);
if( (Process->MitigationFlags2 & 0x40) == 0 && ((*((_QWORD *)&v32 + 1) >> 20) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x80u);
if( (((unsigned __int64)v30.m128i_i64[1] >> 24) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x100u);
if( (Process->MitigationFlags2 & 0x100) == 0 && ((*((_QWORD *)&v32 + 1) >> 24) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x200u);
}
v22 = (unsigned __int64)v30.m128i_i64[1] >> 36;
if( (v22 & 3) == 1 )
{
v23 = 1i64;
goto LABEL_173;
}
if( (((unsigned __int64)v30.m128i_i64[1] >> 36) & 3) == 3 )
{
v23 = 2i64;
LABEL_173:
PspSetNoChildProcessRestrictedPolicy(Process, v23);
}
if( (v22 & 3) != 1 && ((*((_QWORD *)&v32 + 1) >> 36) & 3) == 1 )
PspSetNoChildProcessRestrictedPolicy(Process, 3i64);
if( a2 )
{
v24 = *(_DWORD *)(a2 + 2512);
if( (v24 & 0x10000000) != 0 && (v24 & 0x20000000) == 0 )
v30.m128i_i64[1] = v30.m128i_i64[1] & 0xFFFFCFFFFFFFFFFFui64 | 0x100000000000i64;
}
if( (((unsigned __int64)v30.m128i_i64[1] >> 44) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x10000000u);
}
else if( (((unsigned __int64)v30.m128i_i64[1] >> 44) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2512, 0x30000000u);
}
switch( ((unsigned __int64)v30.m128i_i64[1] >> 60) & 3 )
{
case 0ui64:
if( (a5 & 0x40000) == 0 || (a5 & 0x800000) != 0 || (a5 & 0x1000000) != 0 )
break;
if( (a5 & 0x100000) != 0 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x100000u);
v30.m128i_i64[1] = v30.m128i_i64[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x1000000000000000i64;
LABEL_195:
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x4000u);
break;
case 1ui64:
goto LABEL_195;
case 3ui64:
v30.m128i_i64[1] = v30.m128i_i64[1] & 0xCFFFFFFFFFFFFFFFui64 | 0x1000000000000000i64;
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x4000u);
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x100000u);
break;
}
if( ((*((_QWORD *)&v32 + 1) >> 60) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x8000u);
if( (Process->MitigationFlags2 & 0x4000) == 0 )
{
v25 = v31 & 0xFFFFFFFFFFFFFFFCui64 | 2;
goto LABEL_206;
}
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x20000u);
if( (v31 & 3) != 0 )
{
if( (v31 & 3) == 3 )
goto LABEL_204;
}
else if( (a5 & 0x200000) != 0 )
{
LABEL_204:
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x80000000);
}
v25 = v31 & 0xFFFFFFFFFFFFFFFCui64 | 1;
LABEL_206:
v31 = v25;
if( (v33 & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x40000u);
if( ((v31 >> 4) & 3) == 1 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x200000u);
}
else if( ((v31 >> 4) & 3) == 3 )
{
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x200000u);
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x400000u);
}
if( ((v33 >> 4) & 3) == 1 )
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x800000u);
if( ((v31 >> 16) & 3) == 0 )
{
if( (a5 & 0x400000) != 0 )
goto LABEL_219;
goto LABEL_218;
}
if( ((v31 >> 16) & 3) == 1 )
LABEL_218:
_InterlockedOr((volatile signed __int32 *)&Process->2516, 0x40000000u);
LABEL_219:
v26 = v31 >> 20;
if( (v26 & 3) == 1 )
PspSetRedirectionTrustPolicy(Process, 1i64);
if( (v26 & 3) != 1 && ((v33 >> 20) & 3) == 1 )
PspSetRedirectionTrustPolicy(Process, 2i64);
v27 = v31;
*a3 = v30;
a3[1].m128i_i64[0] = v27;
}Referenced by:
PspAllocateProcess