CmpDoBuildVirtualStack
INT64 __fastcall CmpDoBuildVirtualStack(INT64 a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
INT64 v5;
unsigned int v6;
INT64 v7;
int AccessStateFromSubjectContext;
unsigned int v10;
_DWORD *v11;
UNICODE_STRING *v12;
INT64 v13;
int v14;
int v15;
__int64 v16;
__int64 v17;
unsigned int v18;
UINT64 v19;
INT64 v20;
INT64 v21;
INT64 v23;
INT64 v24;
ULONG_PTR v25;
__int64 v26;
__int64 v27;
__int64 v28;
unsigned int v29;
__int64 BugCheckParameter4[2];
INT64 v31[2];
__int128 v32;
INT64 v33[2];
__int128 v34;
INT64 v35;
INT64 v36;
_DWORD v37[6];
int v38;
int v39;
_QWORD v40[2];
int v41;
KAPC_STATE ApcState;
INT64 v43[11];
INT64 result[20];
__int64 v45[28];
v5 = a3;
v36 = a3;
v6 = a2;
v29 = a2;
v7 = a1;
v35 = a1;
memset((INT64)result, 0i64);
memset((INT64)v45, 0i64);
v27 = 0xFFFFFFFFi64;
v28 = 0xFFFFFFFFi64;
LOBYTE(v26) = 0;
BugCheckParameter4[0] = 0i64;
memset((INT64)v37, 0i64);
v39 = -1;
v40[1] = v40;
v40[0] = v40;
memset((INT64)v43, 0i64);
*(_OWORD *)v31 = 0i64;
WORD1(v31[0]) = -1;
*(_OWORD *)v33 = 0i64;
WORD1(v33[0]) = -1;
v32 = 0i64;
v34 = 0i64;
CmpAttachToRegistryProcess(&ApcState);
v41 |= 1u;
AccessStateFromSubjectContext = SeCreateAccessStateFromSubjectContext(
a5,
(INT64)result,
(INT64)v45,
4i64,
(GENERIC_MAPPING *)((char *)CmKeyObjectType + 76));
if( AccessStateFromSubjectContext >= 0 )
{
v10 = 0;
if( v6 )
{
v11 = (_DWORD *)(v7 + 40);
while( 1 )
{
*(_OWORD *)v33 = 0i64;
v38 = 0;
*(_OWORD *)v31 = 0i64;
v34 = 0i64;
WORD1(v33[0]) = -1;
v32 = 0i64;
WORD1(v31[0]) = -1;
v12 = (UNICODE_STRING *)(v7 + 48i64 * v10);
v13 = *((_QWORD *)v11 - 3);
AccessStateFromSubjectContext = CmpStartKcbStack((INT64)v33, *(_WORD *)(v13 + 66));
if( AccessStateFromSubjectContext < 0 )
break;
AccessStateFromSubjectContext = CmpStartKcbStackForTopLayerKcb((INT64)v31, v13);
if( AccessStateFromSubjectContext < 0 )
break;
v14 = CmpHashUnicodeComponent(v12);
LODWORD(v25) = v14 + 37 * *(_DWORD *)(v13 + 16);
v15 = CmpWalkOneLevel(
v13,
(__int64)v31,
BugCheckParameter4,
(__int64)v33,
(__int64)&v26,
(__int64)v12,
v14,
v25,
0i64,
1,
(__int64)v37);
v16 = BugCheckParameter4[0];
AccessStateFromSubjectContext = v15;
if( v15 < 0 )
goto LABEL_20;
if( *(_DWORD *)(BugCheckParameter4[0] + 40) == -1 )
{
if( *v11 == 1 || *(int *)(v13 + 40) < 0 )
v38 = 1;
v37[0] = 1;
CmpLockKcbStackTopExclusiveRestShared((__int64)v31);
CmpLockKcbStackTopExclusiveRestShared((__int64)v33);
LODWORD(v24) = 3;
AccessStateFromSubjectContext = CmpCreateChild(
(INT64)v31,
(INT64)v33,
(INT64)result,
v12,
(INT64)v37,
512,
v24,
0,
0i64);
if( AccessStateFromSubjectContext < 0 )
{
CmpUnlockKcbStack((__int64)v33);
CmpUnlockKcbStack((__int64)v31);
LABEL_20:
if( v16 )
CmpDereferenceKeyControlBlock(v16);
break;
}
CmpUnlockKcbStack((__int64)v33);
CmpUnlockKcbStack((__int64)v31);
}
CmpUnlockHashEntryByKcb(v16);
v6 = v29;
v7 = v35;
*((_QWORD *)v11 - 2) = v16;
*(v11 - 1) = *(_DWORD *)(v16 + 40);
if( v10 < v6 - 1 )
{
v17 = 6i64 * (v10 + 1);
*(_QWORD *)(v7 + 8 * v17 + 16) = v16;
*(_DWORD *)(v7 + 8 * v17 + 32) = *(_DWORD *)(v16 + 40);
}
BugCheckParameter4[0] = 0i64;
CmpCleanupKcbStack((INT64)v33);
CmpCleanupKcbStack((INT64)v31);
++v10;
v11 += 12;
if( v10 >= v6 )
{
v5 = v36;
goto LABEL_17;
}
}
CmpCleanupKcbStack((INT64)v33);
CmpCleanupKcbStack((INT64)v31);
}
else
{
LABEL_17:
v18 = *(_DWORD *)(v7 + 48i64 * (v6 - 1) + 36);
v19 = *(_QWORD *)(v7 + 48i64 * (v6 - 1) + 24);
HvMarkCellDirty(*(_QWORD *)(a4 + 32), *(unsigned int *)(a4 + 40), 0);
HvMarkCellDirty(v5, v18, 0);
v20 = (*(__int64(__fastcall **)(_QWORD, _QWORD, __int64 *))(*(_QWORD *)(a4 + 32) + 8i64))(
*(_QWORD *)(a4 + 32),
*(unsigned int *)(a4 + 40),
&v27);
if( v20 )
{
v21 = (*(__int64(__fastcall **)(INT64, _QWORD, __int64 *))(v5 + 8))(v5, v18, &v28);
if( v21 )
{
CmpLockTwoSecurityCachesExclusiveShared(v5, *(_QWORD *)(a4 + 32));
LODWORD(v23) = v18;
AccessStateFromSubjectContext = CmpCopySaclToVirtualKey(*(_QWORD *)(a4 + 32), v20, v5, v21, v23);
CmpUnlockTwoSecurityCaches((_CMHIVE *)v5, *(_CMHIVE **)(a4 + 32));
if( AccessStateFromSubjectContext >= 0 )
{
CmpAssignSecurityToKcb(v19, *(unsigned int *)(v21 + 44), 0i64, 0, 0);
*(_WORD *)(v19 + 186) |= 0x100u;
*(_WORD *)(v21 + 2) |= 0x100u;
*(_WORD *)(a4 + 186) |= 0x80u;
*(_WORD *)(v20 + 2) |= 0x80u;
AccessStateFromSubjectContext = 0;
}
}
else
{
AccessStateFromSubjectContext = -1073741670;
}
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(a4 + 32) + 16i64))(*(_QWORD *)(a4 + 32), &v27);
if( v21 )
(*(void(__fastcall **)(_QWORD, __int64 *))(*(_QWORD *)(v19 + 32) + 16i64))(*(_QWORD *)(v19 + 32), &v28);
}
else
{
AccessStateFromSubjectContext = -1073741670;
}
}
SeDeleteAccessState((_ACCESS_STATE *)result);
}
if( (v41 & 1) != 0 )
{
CmpDetachFromRegistryProcess(&ApcState);
v41 &= ~1u;
}
CmpCleanupParseContext((__int64)v37, 1);
return(unsigned int)AccessStateFromSubjectContext;
}Referenced by:
CmpReplicateKeyToVirtual