PfpPrivSourceEnum
INT64 __fastcall PfpPrivSourceEnum(INT64 a1, INT8 a2, _DWORD *a3){
INT64 v5;
_DWORD *v6;
unsigned __int64 v7;
__int128 *v8;
UINT64 v9;
int v10;
int IsAppContainerOrIdentifyLevelContext;
void *i;
void *v13;
void *j;
_DWORD *NextProcess;
UINT64 v16;
unsigned int v17;
UINT64 v18;
int v19;
unsigned __int64 v20;
void *k;
unsigned __int128 v22;
INT64 v23;
int v24;
__int64 v25;
unsigned __int64 v26;
unsigned __int64 v27;
unsigned __int64 v28;
bool v29;
unsigned int v30;
UINT64 v31;
UINT8 IsAppContainerContext;
char v34;
char v35[2];
int v36;
UINT64 a1a[2];
__int64 v38;
INT64 result[3];
__int64 SessionGlobalVA;
unsigned __int64 v41;
__int64 v42;
int SessionId;
char pszDest[20];
UINT64 v45;
unsigned __int64 v46;
int v47;
unsigned int v48;
UINT64 StoreSizeInBytes;
_DWORD *v50;
__int128 *v51;
INT64 v52;
__int64 v53;
_DWORD *v54;
__int128 v55;
unsigned __int128 v56;
unsigned __int64 v57;
__int128 v58;
__int128 v59;
__int128 v60;
unsigned __int64 SystemInformation[8];
__int128 v62;
v50 = a3;
v52 = a1;
v54 = a3;
memset((INT64)SystemInformation, 0i64);
v60 = 0i64;
v55 = 0i64;
v56 = 0i64;
v57 = 0i64;
IsAppContainerContext = 0;
v58 = 0i64;
v59 = 0i64;
StoreSizeInBytes = 0i64;
*(_OWORD *)a1a = 0i64;
v38 = 0i64;
v5 = 0i64;
v53 = 0i64;
v6 = 0i64;
LODWORD(v7) = 0;
v8 = *(__int128 **)(a1 + 16);
v51 = v8;
v9 = *(unsigned int *)(a1 + 24);
if( (unsigned int)v9 < 0x10 )
{
v10 = -1073741789;
goto LABEL_63;
}
if( a2 )
ProbeForWrite(v8, v9, 8ui64);
v62 = *v8;
*((_DWORD *)v8 + 2) = 0;
if( (_DWORD)v62 != 8 || (DWORD1(v62) & 0xFFFFFFF8) != 0 || (BYTE4(v62) & 3) == 3 )
{
v10 = -1073741811;
goto LABEL_63;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeProfileSingleProcessPrivilege, a2) )
{
v34 = 1;
}
else
{
IsAppContainerOrIdentifyLevelContext = SeIsAppContainerOrIdentifyLevelContext(0i64, &IsAppContainerContext);
v10 = IsAppContainerOrIdentifyLevelContext;
if( IsAppContainerOrIdentifyLevelContext == -1073741659 )
{
IsAppContainerContext = 1;
}
else if( IsAppContainerOrIdentifyLevelContext < 0 )
{
goto LABEL_63;
}
v34 = 0;
v8 = v51;
}
if( !IsAppContainerContext )
{
a1a[1] = 1i64;
for( i = 0i64; ; i = v13 )
{
LODWORD(v13) = MmGetNextSession(i);
v5 = (INT64)v13;
if( !v13 )
break;
++a1a[1];
}
}
for( j = 0i64; ; j = NextProcess )
{
NextProcess = ExGetNextProcess(j, 0);
v6 = NextProcess;
if( !NextProcess )
break;
++a1a[1];
}
if( a1a[1] > 0xFFFFFFFF || (v16 = 96 * a1a[1] + 16, v16 > 0xFFFFFFFF) )
{
v10 = -1073741670;
goto LABEL_63;
}
LODWORD(v7) = 96 * LODWORD(a1a[1]) + 16;
v17 = *(_DWORD *)(v52 + 24);
if( (unsigned int)v16 > v17 )
{
v10 = -1073741789;
goto LABEL_63;
}
HIDWORD(v38) = (v17 - 16) / 0x60;
a1a[0] = (UINT64)v8;
if( !IsAppContainerContext )
{
memset((INT64)result, 0i64);
RtlStringCbCopyA(pszDest, 0x10ui64, (PSTR)"KernelSpace");
v10 = ZwQuerySystemInformation();
if( v10 < 0 )
goto LABEL_63;
MmQuerySystemMemoryInformation(&v60, v18);
v10 = v19;
if( v19 < 0 )
goto LABEL_63;
v41 = SystemInformation[0] >> 12;
v20 = v60;
if( (unsigned __int64)v60 <= SystemInformation[0] >> 12 )
v20 = SystemInformation[0] >> 12;
v42 = v20;
v10 = PfpPrivSourceAdd(a1a, result);
if( v10 < 0 )
goto LABEL_63;
for( k = 0i64; ; k = (void *)v5 )
{
LODWORD(v23) = MmGetNextSession(k);
v5 = v23;
if( !v23 )
break;
memset((INT64)result, 0i64);
LODWORD(result[0]) = 1;
HIDWORD(result[0]) = MmGetSessionIdEx(v5);
if( v34 )
SessionGlobalVA = MmGetSessionGlobalVA(v5);
MiFillSessionWorkingSetEntry((__int64)&v55, *(_QWORD *)(v5 + 1368));
v41 = v57;
v46 = *((_QWORD *)&v55 + 1);
v22 = v56;
v45 = v22 >> 64;
v42 = v22;
RtlStringCbCopyA(pszDest, 0x10ui64, (PSTR)"Session");
v10 = PfpPrivSourceAdd(a1a, result);
if( v10 < 0 )
goto LABEL_63;
}
}
v6 = ExGetNextProcess(0i64, IsAppContainerContext);
if( v6 )
{
v24 = BYTE4(v62) & 4;
v36 = v24;
do
{
memset((INT64)result, 0i64);
if( !v24 || (v6[543] & 1) == 0 )
{
LODWORD(result[0]) = 2;
HIDWORD(result[0]) = v6[272];
LODWORD(result[1]) = v6[381];
result[2] = (*((_QWORD *)v6 + 136) ^ *((_QWORD *)v6 + 141)) & 0x1FFFFFFFFFFFFFFFi64;
v25 = SessionGlobalVA;
if( v34 )
v25 = (__int64)v6;
SessionGlobalVA = v25;
v26 = *((_QWORD *)v6 + 226);
v41 = v26;
v27 = *((_QWORD *)v6 + 225);
if( v26 > v27 )
v27 = v26;
v46 = v27;
v28 = *((_QWORD *)v6 + 159);
v42 = v28;
if( v28 <= v41 )
v28 = v41;
v42 = v28;
SessionId = MmGetSessionIdEx((INT64)v6);
v35[0] = 0;
PsQueryProcessAttributes((__int64)v6, v35, 0i64);
v29 = SmStoreExistsForProcess((__int64)v6);
v30 = v48 & 0xFFFFFFF6 | v35[0] & 1 | (8 * v29);
v48 = v30;
PsGetProcessDeepFreezeStats((__int64)v6, &v58);
if( *((_QWORD *)&v59 + 1) )
{
v30 |= 2u;
v48 = v30;
v47 = *((_QWORD *)&v59 + 1) / 0x2710ui64;
}
if( *((_BYTE *)v6 + 1850) == 2 )
v48 = v30 | 4;
RtlStringCbCopyA(pszDest, 0x10ui64, (PSTR)v6 + 1448);
if( (BYTE4(v62) & 1) != 0 )
{
MmQueryProcessWorkingSetSwapPages((__int64)v6, &v45);
}
else if( (BYTE4(v62) & 2) != 0 && (int)SmProcessQueryStoreStats((_EPROCESS *)v6, &StoreSizeInBytes, 0i64) >= 0 )
{
v45 = StoreSizeInBytes >> 12;
}
v10 = PfpPrivSourceAdd(a1a, result);
if( v10 < 0 )
goto LABEL_63;
v24 = v36;
}
v6 = ExGetNextProcess(v6, IsAppContainerContext);
}
while( v6 );
}
LODWORD(v7) = 96 * v38 + 16;
v10 = 0;
LABEL_63:
if( v5 )
HalPutDmaAdapter((PADAPTER_OBJECT)v5);
if( v6 )
ObfDereferenceObjectWithTag(v6, 0x6E457350ui64);
if( v10 == -1073741789 )
{
v31 = a1a[1];
if( (unsigned int)(v38 + 1) > a1a[1] )
v31 = (unsigned int)(v38 + 1);
v7 = 96 * v31 + 16;
if( v7 > 0xFFFFFFFF )
{
LODWORD(v7) = 0;
v10 = -1073741670;
}
}
*v50 = v7;
return(unsigned int)v10;
}Referenced by:
PfQuerySuperfetchInformation