SPCallServerHandleWaitForDisplayWindow
NTSTATUS __stdcall SPCallServerHandleWaitForDisplayWindow(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
__int64 v4;
unsigned int *v7;
NTSTATUS v8;
int v9;
int v10;
NTSTATUS v11;
NTSTATUS v12;
unsigned int *v13;
unsigned int i;
__int64 v15;
unsigned int *v16;
unsigned int v17;
unsigned int *v18;
NTSTATUS v19;
int v20;
unsigned int v21;
VOID **PoolWithTag;
int v24;
unsigned int v25;
__int64 v26;
int v27;
unsigned int v28;
int v29;
unsigned int v30;
__int64 v31;
int v32;
unsigned int v33;
unsigned int v34;
unsigned int v35;
unsigned __int64 v36;
unsigned int v37;
unsigned int v38;
_DWORD *v39;
unsigned int v40;
_LARGE_INTEGER v41;
_UNICODE_STRING DestinationString[4];
int v43;
int v44;
v44 = a3;
v4 = 0i64;
if( !a1 || !a2 || !a4 )
return -1073741811;
v13 = *(unsigned int **)(a1 + 8);
if( v13 && *(_DWORD *)a1 > 3u )
{
for( i = 0; i < 3; ++i )
{
v15 = *v13;
v16 = v13 + 1;
if( v13 + 1 < v13 )
goto LABEL_32;
v13 = (unsigned int *)((char *)v16 + v15);
if( (unsigned int *)((char *)v16 + v15) < v16 )
goto LABEL_32;
}
v17 = *v13;
v18 = v13 + 1;
if( v13 + 1 < v13 )
{
LABEL_32:
v8 = -1073741675;
goto LABEL_9;
}
v7 = 0i64;
if( v17 )
v7 = v18;
v8 = 0;
if( v17 == 8 )
{
v4 = *(_QWORD *)v7;
goto LABEL_9;
}
return -1073741789;
}
v8 = -1073741811;
LABEL_9:
if( v8 >= 0 )
{
v44 = 0;
v43 = 0;
v41.anonymous_0.LowPart = 0;
DestinationString[0] = 0i64;
v9 = 1;
RtlInitUnicodeString(DestinationString, L"Security-SPP-GenuineLocalStatus");
v10 = ((__int64(__fastcall *)(_UNICODE_STRING *, int *, int *, __int64, _LARGE_INTEGER *))qword_140D2C4B8)(
DestinationString,
&v44,
&v43,
4i64,
&v41);
v8 = v10;
if( v10 != -1073741772 )
{
if( v10 < 0 )
return v8;
if( v44 != 4 || !v43 )
v9 = 0;
if( v9 )
KeResetEvent((_KEVENT *)((char *)&SbiVmbusArrivalEvent + 2816));
}
dword_140D2C1D4 = 1;
do
{
v11 = KeWaitForSingleObject((UINT64)&SbiVmbusArrivalEvent + 2816, 6, 1, 1, 0i64);
v12 = v11;
}
while( v11 == 257 );
if( v11 >= 0 && v11 != 192 )
{
do
{
v19 = KeWaitForSingleObject((UINT64)&SbiVmbusArrivalEvent + 2848, 6, 1, 1, 0i64);
v12 = v19;
}
while( v19 == 257 );
if( v19 >= 0 && v19 != 192 && v19 != 258 )
KeReleaseMutex((_KMUTANT *)((char *)&SbiVmbusArrivalEvent + 2848), 0);
}
v20 = *(_DWORD *)(a2 + 32);
if( *(_DWORD *)(a2 + 16) >= 0xFFFFFFC8 )
return -1073741675;
v21 = *(_DWORD *)(a2 + 16) + 60;
if( v21 < *(_DWORD *)(a2 + 16) + 56 )
return -1073741675;
v8 = v21 + v20 < v21 ? 0xC0000095 : 0;
if( v21 + v20 >= v21 )
{
*(_DWORD *)(a4 + 4) = 28;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x1Cui64, 542329939i64);
if( !PoolWithTag )
return -1073741801;
*(_QWORD *)(a4 + 8) = PoolWithTag;
*(_DWORD *)a4 = 0;
v24 = v12 | 0x10000000;
if( (VOID **)((char *)PoolWithTag + 4) < PoolWithTag )
return -1073741675;
if( PoolWithTag + 1 <= (VOID **)((char *)PoolWithTag + *(unsigned int *)(a4 + 4)) )
{
*(_DWORD *)PoolWithTag = 4;
*((_DWORD *)PoolWithTag + 1) = v24;
v25 = ++*(_DWORD *)a4;
v26 = *(_QWORD *)(a4 + 8);
v27 = -1;
if( !v26 )
{
v28 = *(_DWORD *)(a4 + 4);
v29 = -1;
v30 = v28 + 12;
if( v28 + 12 >= v28 )
v29 = v28 + 12;
v8 = v30 < v28 ? 0xC0000095 : 0;
*(_DWORD *)(a4 + 4) = v29;
if( v30 >= v28 )
{
*(_DWORD *)a4 = v25 + 1;
LABEL_55:
v31 = *(_QWORD *)(a4 + 8);
v32 = dword_140D2C064;
if( !v31 )
{
v33 = *(_DWORD *)(a4 + 4);
v34 = v33 + 8;
if( v33 + 8 >= v33 )
v27 = v33 + 8;
v8 = v34 < v33 ? 0xC0000095 : 0;
*(_DWORD *)(a4 + 4) = v27;
if( v34 >= v33 )
{
++*(_DWORD *)a4;
return 0;
}
return v8;
}
v38 = 0;
v39 = *(_DWORD **)(a4 + 8);
if( *(_DWORD *)a4 )
{
while( 1 )
{
v40 = *v39 + 4;
if( *v39 >= 0xFFFFFFFC || (_DWORD *)((char *)v39 + v40) < v39 )
break;
++v38;
v39 = (_DWORD *)((char *)v39 + v40);
if( v38 >= *(_DWORD *)a4 )
goto LABEL_72;
}
}
else
{
LABEL_72:
if( v39 + 1 >= v39 )
{
v8 = 0;
if( (unsigned __int64)(v39 + 2) <= v31 + (unsigned __int64)*(unsigned int *)(a4 + 4) )
{
*v39 = 4;
v39[1] = v32;
++*(_DWORD *)a4;
return v8;
}
return -1073741789;
}
}
return -1073741675;
}
LABEL_22:
if( v8 < 0 )
return v8;
goto LABEL_55;
}
v35 = 0;
v36 = *(_QWORD *)(a4 + 8);
if( v25 )
{
while( 1 )
{
v37 = *(_DWORD *)v36 + 4;
if( *(_DWORD *)v36 >= 0xFFFFFFFC )
break;
if( v36 + v37 < v36 )
return -1073741675;
++v35;
v36 += v37;
if( v35 >= v25 )
goto LABEL_64;
}
v8 = -1073741675;
goto LABEL_22;
}
LABEL_64:
if( v36 + 4 < v36 )
return -1073741675;
v8 = 0;
if( v36 + 12 <= v26 + (unsigned __int64)*(unsigned int *)(a4 + 4) )
{
*(_DWORD *)v36 = 8;
*(_QWORD *)(v36 + 4) = v4;
++*(_DWORD *)a4;
goto LABEL_22;
}
}
return -1073741789;
}
}
return v8;
}Referenced by:
sub_1405F50F8