PspBuildCreateProcessContext
NTSTATUS __stdcall PspBuildCreateProcessContext(
PS_ATTRIBUTE_LIST *AttributeList,
INT8 PreviousMode,
UINT64 IsThreadCreate,
PSP_CREATE_PROCESS_CONTEXT *CreateContext){
INT8 v4;
PSP_CREATE_PROCESS_CONTEXT *v6;
unsigned __int64 v7;
unsigned __int64 v9;
__int64 v10;
PS_ATTRIBUTE_LIST *v11;
unsigned __int64 v12;
unsigned __int64 v13;
int v14;
PSP_CREATE_PROCESS_CONTEXT v15;
unsigned __int64 v16;
unsigned __int64 v17;
unsigned __int64 v18;
unsigned __int64 v19;
unsigned __int64 v20;
unsigned __int64 v21;
__int64 v22;
_BYTE *v23;
UINT64 v24;
unsigned __int64 v25;
PSP_CREATE_PROCESS_CONTEXT *v26;
UINT64 v27;
char *v28;
VOID *v29;
unsigned __int64 v30;
unsigned __int64 v31;
unsigned __int64 v32;
unsigned __int64 v33;
unsigned __int64 v34;
unsigned __int64 v35;
__int64 v36;
int v37;
unsigned __int64 v38;
unsigned __int64 v39;
unsigned __int64 v40;
unsigned __int64 v41;
unsigned __int64 v42;
__int64 v43;
UINT64 v44;
unsigned __int64 v45;
VOID *v46;
unsigned __int64 v47;
unsigned __int64 i;
UINT64 v49;
unsigned __int64 v50;
VOID *v51;
unsigned __int64 v52;
unsigned __int64 v53;
__int128 v54;
__int64 v55;
__int64 v56;
UINT64 v57;
unsigned __int64 v58;
VOID *v59;
__int64 v60;
unsigned __int64 v61;
unsigned __int64 v62;
unsigned __int64 v63;
unsigned __int64 v64;
unsigned __int64 v65;
unsigned __int64 v66;
__int64 v67;
UINT8 valid;
bool v69;
unsigned __int64 v70;
unsigned __int64 v71;
unsigned __int64 v72;
__int128 v73;
__int64 v74;
__int64 v75;
UINT64 v76;
__int64 v77;
_OWORD *v78;
VOID **v79;
__int64 v80;
unsigned __int16 *v81;
char *v82;
unsigned __int64 v83;
unsigned __int16 v84;
__int64 v85;
INT8 v86;
__int64 v87;
_DWORD *v88;
__int64 v89;
unsigned __int64 v90;
char *v91;
__int64 v92;
char *v93;
VOID *v94;
unsigned __int64 v95;
_QWORD *PoolWithQuotaTag;
_DWORD *v97;
__int64 v98;
NTSTATUS ProcessorIndexFromNumber;
unsigned __int64 v100;
unsigned __int64 v101;
unsigned __int64 v102;
unsigned __int64 v103;
unsigned __int64 v104;
_PS_PROTECTION v105;
__int64 v106;
__int64 UmsContextExtendedSize;
unsigned __int64 v108;
unsigned __int64 v109;
__int64 v110;
INT64 *Tag;
VOID **Object;
_OBJECT_HANDLE_INFORMATION *HandleInformation;
PS_ATTRIBUTE_LIST *v114;
unsigned __int16 v115;
unsigned __int64 v116;
unsigned __int64 v117;
unsigned __int64 v118;
_PROCESSOR_NUMBER ProcNumber;
unsigned __int64 v120;
int v121;
int v122;
char *v123;
PSP_CREATE_PROCESS_CONTEXT *v124;
PSP_CREATE_PROCESS_CONTEXT *v125;
PSP_CREATE_PROCESS_CONTEXT *v126;
__int64 v127;
_BYTE *v128;
unsigned __int64 v129;
unsigned __int64 v130;
unsigned __int64 v131;
__int64 v132;
__int64 v133;
VOID *v134;
unsigned __int64 v135;
__int64 v136;
unsigned __int64 v137;
__int64 v138;
__int64 v139;
__int64 v140;
__int64 v141;
PSP_CREATE_PROCESS_CONTEXT *v142;
__int64 v143;
__int64 v144;
unsigned __int64 v145;
char *v146;
VOID *v147;
unsigned __int64 v148;
unsigned __int64 v149;
int v150;
char *v151;
unsigned __int64 v152;
char *v153;
char *v154;
unsigned __int64 v155;
unsigned __int64 v156;
UINT64 MitigationOptions[2];
__int64 v158;
INT64 v159[2];
__int64 v160;
__int128 v161;
__int64 v162;
__int128 v163;
__int64 v164;
int v166;
v166 = IsThreadCreate;
v142 = CreateContext;
v4 = PreviousMode;
v122 = IsThreadCreate;
v126 = CreateContext;
v6 = CreateContext;
v124 = CreateContext;
v147 = 0i64;
v130 = 0i64;
v127 = 0i64;
v163 = 0i64;
v164 = 0i64;
v161 = 0i64;
v162 = 0i64;
v146 = 0i64;
v139 = 0i64;
v137 = 0i64;
ProcNumber = 0;
v143 = 0i64;
v131 = 0i64;
v135 = 0i64;
v134 = 0i64;
v136 = 0i64;
v128 = 0i64;
v145 = 0i64;
v132 = 0i64;
v121 = 0;
v129 = 0i64;
v133 = 0i64;
v138 = 0i64;
v155 = 0i64;
v149 = 0i64;
v154 = 0i64;
v141 = 0i64;
v123 = 0i64;
v151 = 0i64;
v152 = 0i64;
v125 = 0i64;
v140 = 0i64;
v144 = 0i64;
v148 = 0i64;
*(_BYTE *)CreateContext = PreviousMode;
if( PreviousMode && ((unsigned __int8)AttributeList & 3) != 0 )
ExRaiseDatatypeMisalignment();
v7 = *(_QWORD *)AttributeList;
v120 = v7;
if( v7 < 0x28 )
return -1073741811;
if( v4 && v7 != 40 )
{
if( ((unsigned __int8)AttributeList & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)AttributeList + v7 > 0x7FFFFFFF0000i64
|| (PS_ATTRIBUTE_LIST *)((char *)AttributeList + v7) < AttributeList + 10 )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
v9 = v7 - 8;
v120 = v9;
if( (v9 & 0x1F) != 0 )
return -1073741811;
v10 = v9 >> 5;
v120 = v10;
v11 = AttributeList + 2;
v114 = AttributeList + 2;
v12 = 0x7FFFFFFF8i64;
while( v10 )
{
v13 = *(_QWORD *)v11;
v156 = *(_QWORD *)v11;
if( (_DWORD)IsThreadCreate && (v13 & 0x10000) == 0 )
goto LABEL_17;
if( (v13 & 0x20000) != 0 && *((_QWORD *)v11 + 3) )
goto LABEL_17;
v150 = 1 << v13;
v15 = CreateContext[1];
if( ((1 << v13) & v15) != 0 )
goto LABEL_17;
CreateContext[1] = v15 | (1 << v13);
if( v13 > 0x20015 )
{
if( v13 > 0x3000E )
{
v100 = v13 - 196623;
if( !v100 )
{
if( !(_DWORD)IsThreadCreate || !v4 || *((_QWORD *)v11 + 1) != 24i64 )
goto LABEL_17;
v144 = *((_QWORD *)v11 + 2);
if( (v144 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v106 = v144;
*((_OWORD *)CreateContext + 21) = *(_OWORD *)v144;
*((_QWORD *)CreateContext + 44) = *(_QWORD *)(v106 + 16);
if( CreateContext[84] != 256 )
{
LABEL_17:
v14 = -1073741811;
goto LABEL_305;
}
UmsContextExtendedSize = (unsigned int)RtlGetUmsContextExtendedSize();
v109 = *((_QWORD *)CreateContext + 43);
if( (unsigned __int64)(UmsContextExtendedSize - 1) > 0xFFFE )
{
if( UmsContextExtendedSize )
{
if( (v109 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v109 + UmsContextExtendedSize > v108 || v109 + UmsContextExtendedSize < v109 )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else if( (v109 & 3) != 0 )
{
ExRaiseDatatypeMisalignment();
}
v110 = *((_QWORD *)CreateContext + 44);
if( (v110 & 3) != 0 )
ExRaiseDatatypeMisalignment();
goto LABEL_158;
}
v101 = v100 - 196593;
if( v101 )
{
v102 = v101 - 1;
if( v102 )
{
v103 = v102 - 1;
if( v103 )
{
v104 = v103 - 15;
if( !v104 )
{
if( *((_QWORD *)v11 + 1) != 1i64 )
goto LABEL_17;
v105.Level = *((_BYTE *)v11 + 16);
*((_PS_PROTECTION *)CreateContext + 384) = v105;
valid = RtlValidProcessProtection(v105);
goto LABEL_189;
}
if( v104 != 9 || *((_QWORD *)v11 + 1) != 1i64 )
goto LABEL_17;
*((_BYTE *)CreateContext + 9) = *((_BYTE *)CreateContext + 9) & 0x7F | (*((_QWORD *)v11 + 2) != 0i64 ? 0x80 : 0);
}
else
{
if( *((_QWORD *)v11 + 1) != 8i64 )
goto LABEL_17;
*((_QWORD *)CreateContext + 18) = *((_QWORD *)v11 + 2);
}
}
else
{
if( *((_QWORD *)v11 + 1) != 8i64 )
goto LABEL_17;
*((_QWORD *)CreateContext + 17) = *((_QWORD *)v11 + 2);
}
}
else
{
if( *((_QWORD *)v11 + 1) != 8i64 )
goto LABEL_17;
*((_QWORD *)CreateContext + 15) = *((_QWORD *)v11 + 2);
}
}
else
{
if( v13 == 196622 )
{
if( !(_DWORD)IsThreadCreate || *((_QWORD *)v11 + 1) != 4i64 )
goto LABEL_17;
v98 = *((_QWORD *)v11 + 2);
v143 = v98;
if( v4 )
{
if( (v98 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v98 = v143;
}
ProcNumber = *(_PROCESSOR_NUMBER *)v98;
ProcessorIndexFromNumber = KeGetProcessorIndexFromNumber(&ProcNumber.Group);
CreateContext[63] = ProcessorIndexFromNumber;
v69 = ProcessorIndexFromNumber == -1;
goto LABEL_190;
}
v61 = v13 - 131094;
if( !v61 )
{
if( *((_QWORD *)v11 + 1) != 8i64 )
goto LABEL_17;
v95 = *((_QWORD *)v11 + 2);
v155 = v95;
if( v4 )
{
if( (v95 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v95 + 8 > 0x7FFFFFFF0000i64 || v95 + 8 < v95 )
MEMORY[0x7FFFFFFF0000] = 0;
}
PoolWithQuotaTag = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 8ui64, 0x77736350ui64);
*((_QWORD *)CreateContext + 59) = PoolWithQuotaTag;
if( !PoolWithQuotaTag )
{
v14 = -1073741801;
goto LABEL_305;
}
*PoolWithQuotaTag = *(_QWORD *)v95;
v97 = (_DWORD *)*((_QWORD *)CreateContext + 59);
if( (*v97 & 3) == 0 || (unsigned int)(v97[1] - 1) > 5 )
goto LABEL_17;
goto LABEL_247;
}
v62 = v61 - 1;
if( !v62 )
{
if( *((_QWORD *)v11 + 1) != 524i64 )
goto LABEL_17;
v93 = (char *)*((_QWORD *)v11 + 2);
v154 = v93;
if( v4 && ((unsigned __int64)(v93 + 524) > 0x7FFFFFFF0000i64 || v93 + 524 < v93) )
MEMORY[0x7FFFFFFF0000] = 0;
v94 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 0x20Cui64, 0x634F7350ui64);
*((_QWORD *)CreateContext + 53) = v94;
if( !v94 )
goto LABEL_52;
memmove(v94, v93, 0x20Cu);
CreateContext[108] = 524;
goto LABEL_247;
}
v63 = v62 - 1;
if( !v63 )
{
v76 = *((_QWORD *)v11 + 1);
if( v76 != 40 )
goto LABEL_17;
v77 = *((_QWORD *)v11 + 2);
v141 = v77;
if( v4 )
{
if( (v77 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v76 = 40i64;
v77 = v141;
}
v78 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v76, 0x70426E50ui64);
v79 = (VOID **)(CreateContext + 110);
v125 = CreateContext + 110;
*((_QWORD *)CreateContext + 55) = v78;
if( !v78 )
goto LABEL_52;
*v78 = 0i64;
v78[1] = 0i64;
*((_QWORD *)v78 + 4) = 0i64;
memmove(*v79, (const VOID *)v77, v76);
v80 = (__int64)v142;
v81 = (unsigned __int16 *)*v79;
v125 = (PSP_CREATE_PROCESS_CONTEXT *)v81;
v82 = (char *)*((_QWORD *)v81 + 1);
v153 = v82;
v151 = v82;
v83 = *((_QWORD *)v81 + 3);
v152 = v83;
*((_QWORD *)v81 + 1) = 0i64;
*((_QWORD *)*v79 + 3) = 0i64;
v84 = *v81;
if( *v81 )
{
v85 = v81[1];
if( v84 > (unsigned __int16)v85 || (v84 & 1) != 0 || (v85 & 1) != 0 || (_WORD)v85 == 0xFFFF || !v82 )
goto LABEL_17;
v86 = PreviousMode;
if( PreviousMode && (_WORD)v85 && ((unsigned __int64)&v82[v85] > 0x7FFFFFFF0000i64 || &v82[v85] < v82) )
MEMORY[0x7FFFFFFF0000] = 0;
}
else
{
v86 = PreviousMode;
}
v87 = *((unsigned int *)*v79 + 4);
v88 = *v79;
if( (_DWORD)v87 )
{
if( !v83 || (unsigned int)v87 > 0xFFFF )
goto LABEL_17;
if( v86 )
{
v89 = 8 * v87;
if( v89 )
{
if( (v83 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v90 = v83 + v89;
if( v90 > 0x7FFFFFFF0000i64 || v90 < v83 )
{
MEMORY[0x7FFFFFFF0000] = 0;
v88 = *(_DWORD **)(v80 + 440);
}
}
}
}
v91 = 0i64;
v123 = 0i64;
v92 = v81[1];
if( (_WORD)v92 || v88[4] )
{
v91 = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v92 + 8i64 * (unsigned int)v88[4], 0x70426E50ui64);
v123 = v91;
LOWORD(v92) = v81[1];
v82 = v153;
}
if( (_WORD)v92 )
{
*((_QWORD *)v81 + 1) = v91;
memmove(v91, v82, v81[1]);
v91 += v81[1];
v123 = v91;
}
if( *((_DWORD *)*v79 + 4) )
{
*((_QWORD *)*v79 + 3) = v91;
memmove(*((VOID **)*v79 + 3), (const VOID *)v83, 8 * *((_DWORD *)*v79 + 4));
}
goto LABEL_246;
}
v64 = v63 - 1;
if( v64 )
{
v65 = v64 - 2;
if( !v65 )
{
v71 = *((_QWORD *)v11 + 1);
if( v71 > 0x18 )
goto LABEL_17;
v163 = 0i64;
v164 = 0i64;
v72 = *((_QWORD *)v11 + 2);
if( v4 && v72 >= 0x7FFFFFFF0000i64 )
v72 = 0x7FFFFFFF0000i64;
memmove(&v163, (const VOID *)v72, v71);
v73 = v163;
*(_OWORD *)v159 = v163;
v74 = v164;
v160 = v164;
v14 = PspValidateMitigationAuditOptions((INT64)v159);
if( v14 < 0 )
goto LABEL_305;
*(_OWORD *)(CreateContext + 122) = v73;
*((_QWORD *)CreateContext + 63) = v74;
goto LABEL_247;
}
v66 = v65 - 2;
if( v66 )
{
if( v66 != 65519 || !(_DWORD)IsThreadCreate || *((_QWORD *)v11 + 1) != 16i64 )
goto LABEL_17;
v67 = *((_QWORD *)v11 + 2);
v139 = v67;
if( v4 )
{
if( (v67 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v67 = v139;
}
*((_OWORD *)CreateContext + 20) = *(_OWORD *)v67;
valid = KeVerifyGroupAffinity((_GROUP_AFFINITY *)CreateContext + 20, 1u);
LABEL_189:
v69 = valid == 0;
LABEL_190:
if( v69 )
goto LABEL_17;
LABEL_247:
v12 = 0x7FFFFFFF8i64;
LODWORD(IsThreadCreate) = v166;
v4 = PreviousMode;
goto LABEL_248;
}
if( *((_QWORD *)v11 + 1) != 4i64 )
goto LABEL_17;
v70 = *((_QWORD *)v11 + 2);
v149 = v70;
if( v4 )
{
if( (v70 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v70 + 4 > 0x7FFFFFFF0000i64 || v70 + 4 < v70 )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (*(_DWORD *)v70 & 0xFFFFFFFE) != 0 )
return -1073741811;
*((_QWORD *)CreateContext + 60) = v70;
}
else
{
if( *((_QWORD *)v11 + 1) != 4i64 )
goto LABEL_17;
v75 = *((_QWORD *)v11 + 2);
v140 = v75;
if( v4 )
{
if( (v75 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v75 = v140;
}
CreateContext[112] = *(_DWORD *)v75;
}
}
}
else if( v13 == 131093 )
{
if( *((_QWORD *)v11 + 1) != 4i64 )
goto LABEL_17;
v60 = *((_QWORD *)v11 + 2);
v138 = v60;
if( v4 )
{
if( (v60 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v60 = v138;
}
CreateContext[105] = *(_DWORD *)v60;
}
else if( v13 > 0x2000A )
{
v38 = v13 - 131083;
if( !v38 )
{
v57 = *((_QWORD *)v11 + 1);
if( !v57 || (v57 & 7) != 0 || (v57 & 0xFFFFFFFFFFFFFFF8ui64) > v12 )
goto LABEL_17;
v58 = *((_QWORD *)v11 + 2);
v137 = v58;
if( v4 )
{
if( (v58 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v58 + v57 > 0x7FFFFFFF0000i64 || v58 + v57 < v58 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v59 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v57, 0x6C487350ui64);
*((_QWORD *)CreateContext + 37) = v59;
if( !v59 )
{
LABEL_52:
v14 = -1073741670;
goto LABEL_305;
}
memmove(v59, (const VOID *)v58, v57);
CreateContext[73] = v57 >> 3;
goto LABEL_247;
}
v39 = v38 - 2;
if( !v39 )
{
if( *((_QWORD *)v11 + 1) != 2i64 )
goto LABEL_17;
v56 = *((_QWORD *)v11 + 2);
v136 = v56;
if( v4 )
{
if( (v56 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v56 = v136;
}
v115 = *(_WORD *)v56;
if( *(_WORD *)v56 >= (unsigned __int16)KeNumberNodes )
goto LABEL_17;
_mm_lfence();
if( !*(_QWORD *)(KeNodeBlock[v115] + 136) )
goto LABEL_17;
*((_WORD *)CreateContext + 125) = v115;
LABEL_158:
v11 = v114;
goto LABEL_248;
}
v40 = v39 - 3;
if( !v40 )
{
v52 = *((_QWORD *)v11 + 1);
if( v52 > 0x18 )
goto LABEL_17;
v161 = 0i64;
v162 = 0i64;
v53 = *((_QWORD *)v11 + 2);
if( v4 && v53 >= 0x7FFFFFFF0000i64 )
v53 = 0x7FFFFFFF0000i64;
memmove(&v161, (const VOID *)v53, v52);
v54 = v161;
*(_OWORD *)MitigationOptions = v161;
v55 = v162;
v158 = v162;
v14 = PspValidateMitigationOptions((UINT64)MitigationOptions, 0i64);
if( v14 < 0 )
goto LABEL_305;
*(_OWORD *)(CreateContext + 90) = v54;
*((_QWORD *)CreateContext + 47) = v55;
goto LABEL_247;
}
v41 = v40 - 2;
if( !v41 )
{
v49 = *((_QWORD *)v11 + 1);
if( !v49 || (v49 & 7) != 0 || v49 > 0x88 )
goto LABEL_17;
v50 = *((_QWORD *)v11 + 2);
v148 = v50;
if( v4 )
{
if( (v50 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v50 + v49 > 0x7FFFFFFF0000i64 || v50 + v49 < v50 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v51 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v49, 0x61547350ui64);
*((_QWORD *)CreateContext + 49) = v51;
if( !v51 )
goto LABEL_52;
memmove(v51, (const VOID *)v50, v49);
CreateContext[102] = v49;
if( !IsTrustletCreateAttributeWellFormed(*((_QWORD **)CreateContext + 49), v49) )
goto LABEL_17;
goto LABEL_247;
}
v42 = v41 - 1;
if( !v42 )
{
v44 = *((_QWORD *)v11 + 1);
if( !v44 || (v44 & 7) != 0 || (v44 & 0xFFFFFFFFFFFFFFF8ui64) > v12 )
goto LABEL_17;
v45 = *((_QWORD *)v11 + 2);
v137 = v45;
if( v4 )
{
if( (v45 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v45 + v44 > 0x7FFFFFFF0000i64 || v45 + v44 < v45 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v46 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v44, 0x6C4A7350ui64);
*((_QWORD *)CreateContext + 50) = v46;
if( !v46 )
goto LABEL_52;
memset(v46, 0i64, v44);
CreateContext[103] = v44 >> 3;
v47 = 0i64;
v135 = 0i64;
for( i = 0i64; i < (unsigned int)CreateContext[103]; ++i )
{
LODWORD(Tag) = 1816818512;
v14 = ObpReferenceObjectByHandleWithTag(
*(VOID **)(v45 + 8 * v47),
1ui64,
(_OBJECT_TYPE *)PsJobType,
PreviousMode,
(UINT64)Tag,
&v134,
0i64,
0i64);
if( v14 < 0 )
goto LABEL_305;
*(_QWORD *)(*((_QWORD *)CreateContext + 50) + 8 * v47) = v134;
v47 = i + 1;
v135 = i + 1;
}
LABEL_246:
v6 = v124;
goto LABEL_247;
}
if( v42 != 1 || *((_QWORD *)v11 + 1) != 4i64 )
goto LABEL_17;
v43 = *((_QWORD *)v11 + 2);
v133 = v43;
if( v4 )
{
if( (v43 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v43 = v133;
}
CreateContext[104] = *(_DWORD *)v43;
}
else if( v13 == 131082 )
{
if( *((_QWORD *)v11 + 1) != 8i64 )
goto LABEL_17;
v36 = *((_QWORD *)v11 + 2);
v132 = v36;
if( v4 )
{
if( (v36 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v36 = v132;
}
if( (*(_DWORD *)v36 & 0x1C) != 0 )
{
v14 = -1073741637;
goto LABEL_305;
}
v37 = *(_DWORD *)v36 & 3;
v121 = v37;
if( (unsigned __int8)v37 >= 3u )
goto LABEL_17;
*((_BYTE *)CreateContext + 9) ^= (*((_BYTE *)CreateContext + 9) ^ (4 * v37)) & 0xC;
if( v37 == 1 )
CreateContext[72] = *(_DWORD *)(v36 + 4);
}
else
{
v16 = v13 - 6;
if( v16 )
{
v17 = v16 - 65533;
if( v17 )
{
v18 = v17 - 1;
if( v18 )
{
v19 = v18 - 65537;
if( !v19 )
{
v27 = *((_QWORD *)v11 + 1);
if( !v27 || (v27 & 1) != 0 || v27 > 0xFFFF )
goto LABEL_17;
v28 = (char *)*((_QWORD *)v11 + 2);
v146 = v28;
if( v4 && ((unsigned __int64)&v28[v27] > 0x7FFFFFFF0000i64 || &v28[v27] < v28) )
MEMORY[0x7FFFFFFF0000] = 0;
v29 = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v27, 0x6E467350ui64);
v147 = v29;
if( !v29 )
goto LABEL_52;
*(_OWORD *)(CreateContext + 58) = 0i64;
*((_WORD *)CreateContext + 117) = v27;
*((_QWORD *)CreateContext + 30) = v29;
memmove(v29, v28, v27);
*((_WORD *)CreateContext + 116) = v27;
goto LABEL_247;
}
v20 = v19 - 2;
if( !v20 )
{
v24 = *((_QWORD *)v11 + 1);
if( !v24 || (v24 & 0xF) != 0 )
goto LABEL_17;
v25 = *((_QWORD *)v11 + 2);
v145 = v25;
if( v4 )
{
if( (v25 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v25 + v24 > 0x7FFFFFFF0000i64 || v25 + v24 < v25 )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( v24 > 0x10 )
{
*((_QWORD *)v6 + 35) = ExAllocatePoolWithQuotaTag((POOL_TYPE)520, v24, 0x6C527350ui64);
v26 = (PSP_CREATE_PROCESS_CONTEXT *)*((_QWORD *)CreateContext + 35);
if( !v26 )
goto LABEL_52;
}
else
{
v26 = CreateContext + 66;
*((_QWORD *)v6 + 35) = CreateContext + 66;
}
memmove(v26, (const VOID *)v25, v24);
*((_QWORD *)CreateContext + 32) = v24 >> 4;
goto LABEL_247;
}
v21 = v20 - 1;
if( v21 )
{
if( v21 != 1 || *((_QWORD *)v11 + 1) != 4i64 )
goto LABEL_17;
v22 = *((_QWORD *)v11 + 2);
v127 = v22;
if( v4 )
{
if( (v22 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v11 = v114;
v22 = v127;
}
CreateContext[79] = *(_DWORD *)v22;
}
else
{
if( *((_QWORD *)v11 + 1) != 1i64 )
goto LABEL_17;
v23 = (_BYTE *)*((_QWORD *)v11 + 2);
v128 = v23;
if( v4 )
{
v11 = v114;
v23 = v128;
}
*((_BYTE *)CreateContext + 248) = *v23;
}
}
else
{
if( *((_QWORD *)v11 + 1) != 8i64 )
goto LABEL_17;
v30 = *((_QWORD *)v11 + 2);
v129 = v30;
if( v4 )
{
if( (v30 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v30 >= 0x7FFFFFFF0000i64 )
v30 = 0x7FFFFFFF0000i64;
*(_BYTE *)v30 = *(_BYTE *)v30;
*(_BYTE *)(v30 + 7) = *(_BYTE *)(v30 + 7);
v11 = v114;
v30 = v129;
}
*((_QWORD *)CreateContext + 3) = v30;
v31 = *((_QWORD *)v11 + 3);
v116 = v31;
if( v31 )
{
if( v4 )
{
if( (v31 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v31 >= 0x7FFFFFFF0000i64 )
v31 = 0x7FFFFFFF0000i64;
*(_BYTE *)v31 = *(_BYTE *)v31;
*(_BYTE *)(v31 + 7) = *(_BYTE *)(v31 + 7);
v11 = v114;
v31 = v116;
}
*(_QWORD *)v31 = 8i64;
}
}
}
else
{
if( *((_QWORD *)v11 + 1) != 16i64 )
goto LABEL_17;
v32 = *((_QWORD *)v11 + 2);
v130 = v32;
if( v4 )
{
if( (v32 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v32 >= 0x7FFFFFFF0000i64 )
v32 = 0x7FFFFFFF0000i64;
*(_BYTE *)v32 = *(_BYTE *)v32;
*(_BYTE *)(v32 + 15) = *(_BYTE *)(v32 + 15);
v32 = v130;
v11 = v114;
}
*((_QWORD *)CreateContext + 2) = v32;
v33 = *((_QWORD *)v11 + 3);
v117 = v33;
if( v33 )
{
if( v4 )
{
if( (v33 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v33 >= 0x7FFFFFFF0000i64 )
v33 = 0x7FFFFFFF0000i64;
*(_BYTE *)v33 = *(_BYTE *)v33;
*(_BYTE *)(v33 + 7) = *(_BYTE *)(v33 + 7);
v11 = v114;
v33 = v117;
}
*(_QWORD *)v33 = 16i64;
}
}
}
else
{
if( *((_QWORD *)v11 + 1) != 64i64 )
goto LABEL_17;
v34 = *((_QWORD *)v11 + 2);
v131 = v34;
if( v4 )
{
if( (v34 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v34 >= 0x7FFFFFFF0000i64 )
v34 = 0x7FFFFFFF0000i64;
*(_BYTE *)v34 = *(_BYTE *)v34;
*(_BYTE *)(v34 + 63) = *(_BYTE *)(v34 + 63);
v11 = v114;
v34 = v131;
}
*((_QWORD *)CreateContext + 4) = v34;
v35 = *((_QWORD *)v11 + 3);
v118 = v35;
if( v35 )
{
if( v4 )
{
if( (v35 & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( v35 >= 0x7FFFFFFF0000i64 )
v35 = 0x7FFFFFFF0000i64;
*(_BYTE *)v35 = *(_BYTE *)v35;
*(_BYTE *)(v35 + 7) = *(_BYTE *)(v35 + 7);
v11 = v114;
v35 = v118;
}
*(_QWORD *)v35 = 64i64;
}
}
}
LABEL_248:
v11 += 8;
v114 = v11;
v10 = --v120;
}
v14 = 0;
LABEL_305:
if( v14 < 0 )
goto LABEL_311;
if( (CreateContext[1] & 0x800) != 0 )
{
qsort(
*((_QWORD *)CreateContext + 37),
(unsigned int)CreateContext[73],
8ui64,
(INT64)PspSortHandleList,
Tag,
(UINT64)Object,
(UINT64)HandleInformation);
if( **((int **)CreateContext + 37) < 0 )
v14 = -1073741811;
*((_BYTE *)CreateContext + 8) = CreateContext[2] & 0xFE | (v122 != 0);
}
if( v14 < 0 )
LABEL_311:
PspDeleteCreateProcessContext(CreateContext);
return v14;
}Referenced by:
NtCreateThreadEx
NtCreateUserProcess