NtSetInformationProcess
NTSTATUS __fastcall NtSetInformationProcess(UINT64 a1, UINT64 rdx0, UINT64 a3, UINT64 a4){
size_t v4;
__int64 v5;
NTSTATUS v7;
_ETHREAD *v8;
unsigned __int8 v9;
int v10;
NTSTATUS result;
volatile signed __int64 *v12;
int v13;
VOID **PoolWithTag;
UINT8 v15;
void *v16;
VOID *v17;
int v18;
UINT8 v19;
_EPROCESS *v20;
__int16 v21;
_EPROCESS *v22;
int v23;
char v24;
unsigned int v25;
NTSTATUS v26;
_EPROCESS *v27;
_LIST_ENTRY **i;
unsigned int v29;
unsigned int v30;
int v31;
_EX_RUNDOWN_REF *v32;
signed __int64 *v33;
signed __int64 v34;
signed __int64 v35;
_ADAPTER_OBJECT *v36;
NTSTATUS v37;
PVOID v38;
_EPROCESS *v39;
UINT64 v40;
unsigned __int8 v41;
_ETHREAD *v42;
_DWORD *v43;
__int64 v44;
__int16 v45;
_EPROCESS *v46;
unsigned int v47;
_EPROCESS *v48;
__int64 v49;
unsigned __int64 v50;
_ETHREAD *v51;
int v52;
VOID *v53;
_BOOL8 v54;
NTSTATUS v55;
_EPROCESS *v56;
_ETHREAD *v57;
_LIST_ENTRY *Flink;
_LIST_ENTRY **v59;
_LIST_ENTRY *v60;
int v61;
VOID *v62;
NTSTATUS v63;
int v64;
VOID *v65;
unsigned int v66;
unsigned int v67;
unsigned int v68;
VOID *v69;
PROCESS_HANDLE_TRACING_ENABLE_EX *v70;
NTSTATUS v71;
NTSTATUS v72;
unsigned int v73;
unsigned __int64 v74;
NTSTATUS v75;
_EPROCESS *v76;
_ETHREAD *v77;
signed __int32 bf_0;
_IO_PRIORITY_HINT v79;
signed __int32 v80;
_EPROCESS *v81;
_LIST_ENTRY *v82;
int v83;
unsigned int v84;
_EPROCESS *CurrentProcess;
int v86;
unsigned int v87;
NTSTATUS v88;
_EX_RUNDOWN_REF *v89;
_ETHREAD *v90;
unsigned int v91;
signed __int32 v92;
signed __int32 v93;
_EPROCESS *v94;
char *v95;
char *v96;
unsigned int v97;
unsigned __int64 v98;
__int128 *PoolWithQuotaTag;
int v100;
__int64 v101;
unsigned int v102;
_DWORD *v103;
_KPROCESS *v104;
_EWOW64PROCESS *WoW64Process;
unsigned __int16 Machine;
__int64 v107;
_ETHREAD *j;
_QWORD *v109;
__int64 v110;
char *v111;
char *v112;
__int64 v113;
__int64 v114;
UINT64 *v115;
__int64 v116;
VOID *Ptr;
__int64 v118;
__int64 v119;
__int64 Ptr_high;
unsigned __int64 v121;
UINT64 v122;
int v123;
unsigned __int64 v124;
unsigned __int64 v125;
unsigned __int64 v126;
__int64 v127;
__int64 v128;
unsigned __int64 v129;
_KPROCESS *v130;
INT8 v131;
_EWOW64PROCESS *v132;
unsigned __int16 v133;
bool v134;
_EWOW64PROCESS *v135;
unsigned __int16 v136;
_ETHREAD *v137;
_LIST_ENTRY *v138;
unsigned __int16 v139;
_DWORD *Peb;
_EWOW64PROCESS *v141;
_QWORD *v142;
int v143;
char v144;
unsigned int v145;
_ADAPTER_OBJECT *v146;
unsigned __int64 v147;
UINT64 v148;
_EPROCESS *v149;
int v150;
int v151;
_HANDLE_TABLE *v152;
unsigned int v153;
int v154;
int v155;
unsigned int v156;
int v157;
_KPROCESS *v158;
UINT64 *p_MitigationFlags;
int v160;
char v161;
UINT64 v162;
int v163;
int v164;
unsigned int v165;
UINT64 v166;
bool v167;
int v168;
int v169;
int v170;
unsigned int MitigationFlags;
unsigned int v172;
int v173;
unsigned int v174;
int v175;
int v176;
UINT64 v177;
unsigned int v178;
int v179;
UINT64 v180;
unsigned int v181;
int v182;
unsigned int v183;
int v184;
int v185;
int v186;
int v187;
unsigned int v188;
UINT64 v189;
unsigned int v190;
NTSTATUS NoChildProcessRestrictedPolicy;
NTSTATUS v192;
int v193;
int v194;
int v195;
unsigned int v196;
NTSTATUS RedirectionTrustPolicy;
int v198;
int v199;
int v200;
_EPROCESS *v201;
unsigned int v202;
int v203;
int v204;
int v205;
int v206;
int v207;
int v208;
int v209;
char v210;
_EPROCESS *v211;
_HANDLE_TABLE *v212;
VOID **v213;
int v214;
VOID *v215;
unsigned __int64 v216;
VOID **v217;
VOID *v218;
NTSTATUS v219;
_BOOL8 v220;
_KPROCESS *v221;
size_t v222;
unsigned int v223;
char v224;
NTSTATUS v225;
unsigned int v226;
_HANDLE_TABLE *v227;
char v228;
int v229;
__int64(__fastcall **ExtensionTable)(PVOID, VOID **);
int v231;
size_t v232;
VOID *v233;
NTSTATUS v234;
__int128 v235;
int v236;
volatile signed __int32 *v237;
unsigned int v238;
volatile signed __int32 *v239;
int v240;
char v241;
unsigned int v242;
_KPROCESS *v243;
void(__fastcall **v244)(_EPROCESS *, _QWORD);
VOID *v245;
NTSTATUS v246;
_KPROCESS *v247;
_PEB *v248;
_DWORD *v249;
_EWOW64PROCESS *v250;
int v251;
unsigned int LeapSecondFlags;
unsigned int v253;
int v254;
unsigned int v255;
NTSTATUS v256;
_DWORD *v257;
unsigned int v258;
const VOID *v259;
_KPROCESS *v260;
_DWORD *Pool2;
unsigned int v262;
const VOID *v263;
_EPROCESS *v264;
_DWORD *v265;
signed __int32 v266;
ULONG Tag[2];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
INT64 v270;
PVOID v271;
unsigned int v272;
int v273;
_ETHREAD *CurrentThread;
char v275;
VOID *v276;
NTSTATUS v277;
int v278;
_HANDLE Handle[2];
__int16 v280;
unsigned int v281;
unsigned int Alignment;
char Alignment_4;
char Alignment_5;
char Alignment_6;
char Alignment_7;
_IO_PRIORITY_HINT TargetPriority;
char *v288;
__int64 v289;
_EX_RUNDOWN_REF *RunRef;
UINT64 AffinitySet;
INT64 a5;
__int64 v293;
UINT64 v294;
PVOID v295;
PVOID v296;
PVOID v297;
__int64 v298;
UINT64 v299;
__int128 v300;
unsigned int v301;
int v302;
unsigned int PagePriority;
unsigned int PagePriority_4;
PVOID v305;
_GROUP_AFFINITY GroupAffinity;
VOID *Src[2];
VOID *Address[2];
UINT64 v309[2];
PVOID v310;
PVOID v311;
__int64 v312;
INT64 a2;
PVOID v314;
PADAPTER_OBJECT DmaAdapter;
unsigned int v316;
unsigned int v317;
unsigned int v318;
unsigned int v319;
unsigned int v320;
unsigned int v321;
unsigned int v322;
VOID *v323;
unsigned __int64 v324;
__int128 *v325;
unsigned int v326;
UINT64 v327;
_BOOL4 v328;
INT64 v329[2];
__int64 v330;
int v331;
unsigned int v332;
unsigned int v333;
unsigned int v334;
unsigned int v335;
__int128 v336;
__int128 v337;
__int64 v338;
_DYNAMIC_FUNCTION_TABLE *DynamicTable[2];
__m256i v340;
PORT_MESSAGE RequestMessage[2];
__int128 v342;
__int128 v343;
__int64 v344;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
VOID *v346;
VOID *v347;
VOID **v348;
VOID *v349;
int v350;
__int128 v351;
_KAPC_STATE ApcState;
__int128 P[2];
__int64 v354;
__int128 v355[9];
UINT64 CpuSetMasks[20];
CHAR pszDest[16];
__int128 v358;
__int128 v359;
__int128 v360;
char v361;
v4 = a4;
v5 = a3;
Alignment = rdx0;
v299 = a3;
v278 = a4;
v7 = 0;
v271 = 0i64;
GroupAffinity = 0i64;
v277 = 0;
v280 = 0;
v294 = 0i64;
v314 = 0i64;
v324 = 0i64;
LODWORD(AffinitySet) = 0;
v351 = 0i64;
v8 = (_ETHREAD *)KeGetCurrentThread();
CurrentThread = v8;
v9 = v8->Tcb.gap0[10];
if( v9 )
{
switch( (_DWORD)rdx0 )
{
case 5:
v10 = 4;
break;
case 0x11:
v10 = 1;
break;
case 0x19:
v10 = 1;
break;
case 0x12:
v10 = 1;
break;
case 0x15:
v10 = 8;
break;
case 0x21:
v10 = 4;
break;
case 0x27:
v10 = 4;
break;
case 0x23:
v10 = 8;
break;
case 8:
v10 = 8;
break;
case 0x28:
v10 = 8;
break;
case 0x29:
v10 = 8;
break;
case 0x62:
v10 = 8;
break;
case 0x63:
v10 = 8;
break;
case 0x2D:
v10 = 4;
break;
case 0x2E:
v10 = 4;
break;
case 0x31:
v10 = 8;
break;
case 0x35:
v10 = 8;
break;
case 0x38:
v10 = 8;
break;
case 0x3E:
v10 = 8;
break;
case 0x41:
v10 = 8;
break;
case 0x46:
v10 = 1;
break;
case 0x4A:
v10 = 1;
break;
case 0x53:
v10 = 8;
break;
case 0x5A:
v10 = 1;
break;
case 0x5B:
v10 = 4;
break;
case 0x5D:
v10 = 4;
break;
case 0x5F:
v10 = 8;
break;
case 0x57:
v10 = 1;
break;
case 0x64:
v10 = 1;
break;
case 0x65:
v10 = 8;
break;
default:
v10 = 4;
if( (_DWORD)rdx0 == 102 )
v10 = 8;
break;
}
if( (_DWORD)a4 )
{
if( ((v10 - 1) & (unsigned int)a3) != 0 )
ExRaiseDatatypeMisalignment();
if( a3 + (unsigned int)a4 > 0x7FFFFFFF0000i64 || a3 + (unsigned int)a4 < a3 )
MEMORY[0x7FFFFFFF0000] = 0;
v8 = CurrentThread;
}
}
switch( (int)rdx0 )
{
case 1:
return PspSetQuotaLimits((VOID *)a1, (VOID *)a3, (unsigned int)a4, v9);
case 5:
if( (_DWORD)a4 != 4 )
return -1073741820;
v331 = *(_DWORD *)a3;
v18 = v331;
if( v331 < 0 )
v18 = v331 & 0x7FFFFFFF;
v19 = v331 < 0 ? 2 : 0;
if( (unsigned int)(v18 - 1) > 0x1E )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v20 = (_EPROCESS *)v271;
if( v18 > *((char *)v271 + 640)
&& !SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege, (VOID *)a1, 0x200ui64, v9) )
{
ObfDereferenceObjectWithTag(v20, 0x79517350ui64);
return -1073741727;
}
Tag[0] = 0;
KeSetPriorityAndQuantumProcess(v20, (unsigned int)v18, 0, 0i64, *(UINT64 *)Tag);
MmSetMemoryPriorityProcess(v20, v19);
ObfDereferenceObjectWithTag(v20, 0x79517350ui64);
return 0;
case 6:
if( (_DWORD)a4 != 4 )
return -1073741820;
v25 = *(_DWORD *)a3;
v332 = *(_DWORD *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
v26 = result;
if( result >= 0 )
{
v27 = (_EPROCESS *)v271;
if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)v271 + 139) )
{
for( i = PsGetNextProcessThread(v27, 0i64); i; i = PsGetNextProcessThread(v27, (_ETHREAD *)i) )
KeBoostPriorityThread((_KTHREAD *)i, v25);
ExReleaseRundownProtection(&v27->RundownProtect);
ObfDereferenceObjectWithTag(v27, 0x79517350ui64);
return v26;
}
else
{
ObfDereferenceObjectWithTag(v27, 0x79517350ui64);
return -1073741558;
}
}
return result;
case 8:
if( (_DWORD)a4 == 8 )
{
v30 = 0;
v301 = 0;
*(_QWORD *)Handle = *(_QWORD *)a3;
v323 = *(VOID **)Handle;
}
else
{
if( (_DWORD)a4 != 16 )
return -1073741820;
*(_QWORD *)Handle = *(_QWORD *)a3;
v323 = *(VOID **)Handle;
v301 = *(_DWORD *)(a3 + 8);
v30 = v301;
if( (v301 & 0xFFFFFFF8) != 0 )
return -1073741811;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
v297 = 0i64;
result = ObReferenceObjectByHandle(*(VOID **)Handle, 0i64, LpcPortObjectType, v9, &v297, 0i64);
DmaAdapter = (PADAPTER_OBJECT)v297;
if( result >= 0 )
{
Tag[0] = 2035381072;
v31 = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x800ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( v31 < 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v297);
return v31;
}
v32 = (_EX_RUNDOWN_REF *)((unsigned __int64)v297 | v30);
RunRef = v32;
v33 = (signed __int64 *)((char *)v271 + 1200);
_m_prefetchw((char *)v271 + 1200);
v34 = *v33;
while( 1 )
{
*(_QWORD *)Handle = v34;
if( v4 == 16 )
{
*(_DWORD *)(v5 + 8) = v34 & 7;
}
else if( (v34 & 7) != 0 )
{
HalPutDmaAdapter(DmaAdapter);
LABEL_133:
v13 = -1073741811;
goto LABEL_142;
}
v35 = _InterlockedCompareExchange64((volatile signed __int64 *)v271 + 150, (signed __int64)v32, v34);
v167 = v34 == v35;
v34 = v35;
if( v167 )
{
if( v35 )
{
v342 = 0i64;
v343 = 0i64;
v36 = (_ADAPTER_OBJECT *)(v35 & 0xFFFFFFFFFFFFFFF8ui64);
RequestMessage[0] = 3145736;
RequestMessage[1] = 13;
v344 = *((_QWORD *)v271 + 136);
while( 1 )
{
v37 = LpcRequestPort(v36, RequestMessage);
if( v37 != -1073741801 && v37 != -1073741670 )
break;
KeDelayExecutionThread(0, 0, (_LARGE_INTEGER *)&unk_1400105B0);
}
PspLockUnlockProcessExclusive((_EPROCESS *)v271, CurrentThread);
HalPutDmaAdapter(v36);
}
v13 = 0;
goto LABEL_142;
}
}
}
return result;
case 9:
if( (_DWORD)a4 != 16 )
return -1073741820;
return PspAssignPrimaryToken(v8, v9, (VOID *)a1, *(VOID **)a3);
case 10:
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x220ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result >= 0 )
goto LABEL_150;
return result;
case 11:
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x220ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result >= 0 )
goto LABEL_150;
return result;
case 12:
if( (_DWORD)a4 != 4 )
return -1073741820;
v29 = *(_DWORD *)a3;
v326 = *(_DWORD *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
PspSetProcessDefaultHardErrorMode((_EPROCESS *)v271, CurrentThread, v29);
goto LABEL_89;
case 13:
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result >= 0 )
{
LABEL_150:
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return xKdEnumerateDebuggingDevices(v39, v38, v40);
}
return result;
case 15:
case 42:
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v12 = (volatile signed __int64 *)v271;
v13 = PsChargeProcessNonPagedPoolQuota((_EPROCESS *)v271, 0x6028ui64);
if( v13 < 0 )
goto LABEL_80;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x6028ui64, 1935110992i64);
if( PoolWithTag )
{
PsWatchEnabled = 1;
*(_DWORD *)PoolWithTag = 0;
PoolWithTag[1] = 0i64;
KeInitializeGate((_KGATE *)(PoolWithTag + 2), v15);
if( !_InterlockedCompareExchange64(v12 + 166, (signed __int64)v16, 0i64) )
{
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return 0;
}
ExFreePoolWithTag(v16, 0);
v13 = -1073741752;
v12 = (volatile signed __int64 *)v271;
}
else
{
v13 = -1073741801;
}
PsReturnProcessNonPagedPoolQuota((_EPROCESS *)v12, 0x6028ui64);
LABEL_80:
ObfDereferenceObjectWithTag((VOID *)v12, 0x79517350ui64);
return v13;
case 16:
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return -1073741822;
case 17:
if( (_DWORD)a4 != 1 )
return -1073741820;
v41 = *(_BYTE *)a3;
Alignment_5 = *(_BYTE *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result >= 0 )
{
v42 = CurrentThread;
v43 = v271;
PspLockProcessExclusive((_EPROCESS *)v271, CurrentThread);
if( v41 )
v43[382] |= 4u;
else
v43[382] &= ~4u;
v44 = *((_QWORD *)v43 + 176);
if( v44 )
{
v45 = *(_WORD *)(v44 + 8);
if( v45 == 332 || v45 == 452 )
v41 = 1;
}
KeSetAutoAlignmentProcess((_KPROCESS *)v43, v41);
PspUnlockProcessExclusive(v46, v42);
ObfDereferenceObjectWithTag(v43, 0x79517350ui64);
return 0;
}
return result;
case 18:
if( (_DWORD)a4 != 2 )
return -1073741820;
v21 = *(_WORD *)a3;
v280 = *(_WORD *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result >= 0 )
{
v22 = (_EPROCESS *)v271;
v23 = PspSetProcessPriorityClass((_EPROCESS *)v271, HIBYTE(v280), (VOID *)a1, v9);
if( v23 >= 0 )
{
LOBYTE(v7) = (_BYTE)v21 != 0;
PsSetProcessPriorityByClass(v22, (_PSPROCESSPRIORITYMODE)v7);
}
ObfDereferenceObjectWithTag(v22, 0x79517350ui64);
return v23;
}
return result;
case 19:
if( (_DWORD)a4 != 4 )
return -1073741820;
v47 = *(_DWORD *)a3;
v333 = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
Tag[0] = 2035381072;
v13 = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( v13 < 0 )
return v13;
if( *((_QWORD *)v271 + 280) )
{
LABEL_169:
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return -1073741790;
}
else
{
if( v47 )
_InterlockedOr((volatile signed __int32 *)v271 + 281, 0x1000000u);
else
_InterlockedAnd((volatile signed __int32 *)v271 + 281, 0xFEFFFFFF);
LABEL_142:
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return v13;
}
case 21:
if( (_DWORD)a4 == 8 )
{
GroupAffinity.Mask = *(_QWORD *)a3;
if( !GroupAffinity.Mask )
return -1073741811;
}
else
{
if( (_DWORD)a4 != 16 )
return -1073741820;
GroupAffinity = *(_GROUP_AFFINITY *)a3;
if( !KeVerifyGroupAffinity(&GroupAffinity, 0) )
return -1073741811;
}
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v48 = (_EPROCESS *)v271;
KeQueryGroupMaskProcess((_EPROCESS *)v271);
if( (((_DWORD)v49 - 1) & (unsigned int)v49) != 0 )
goto LABEL_180;
if( v4 == 8 )
{
_BitScanForward((unsigned int *)&v49, v49);
v277 = v49;
v50 = GroupAffinity.Mask & KeActiveProcessors.Bitmap[v49];
v48 = (_EPROCESS *)v271;
if( v50 != GroupAffinity.Mask )
{
LABEL_180:
ObfDereferenceObjectWithTag(v48, 0x79517350ui64);
return -1073741811;
}
GroupAffinity.Group = v277;
GroupAffinity.Mask = v50;
}
v51 = CurrentThread;
KeEnterCriticalRegionThread(&CurrentThread->Tcb);
if( ExAcquireRundownProtection(&v48->RundownProtect) )
{
PspLockProcessSharedUnsafe(v48);
v52 = PspSetProcessAffinitySafe(v48, 0i64, 0i64, &GroupAffinity, &AffinitySet);
PspUnlockProcessSharedUnsafe(v48);
ExReleaseRundownProtection(&v48->RundownProtect);
if( v52 >= 0 )
{
if( (_DWORD)AffinitySet )
PspWritePebAffinityInfo(v51, (_EX_RUNDOWN_REF *)v48);
_InterlockedOr((volatile signed __int32 *)&v48->1120, 0x200000u);
v53 = v271;
KeLeaveCriticalRegionThread(&v51->Tcb);
ObfDereferenceObjectWithTag(v53, 0x79517350ui64);
return v52;
}
}
else
{
v52 = -1073741558;
}
KeLeaveCriticalRegionThread(&v51->Tcb);
ObfDereferenceObjectWithTag(v48, 0x79517350ui64);
return v52;
case 22:
if( (_DWORD)a4 != 4 )
return -1073741820;
v334 = *(_DWORD *)a3;
v54 = v334 != 0;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
v55 = result;
if( result < 0 )
return result;
v56 = (_EPROCESS *)v271;
if( !ExAcquireRundownProtection((_EX_RUNDOWN_REF *)v271 + 139) )
goto LABEL_194;
v57 = CurrentThread;
PspLockProcessExclusive(v56, CurrentThread);
KeSetDisableBoostProcess(&v56->Pcb, v54);
Flink = v56->ThreadListHead.Flink;
if( Flink != &v56->ThreadListHead )
{
do
{
KeSetDisableBoostThread((_KTHREAD *)&Flink[-79].Blink, v54);
Flink = *v59;
}
while( Flink != v60 );
}
PspUnlockProcessExclusive(v56, v57);
ExReleaseRundownProtection(&v56->RundownProtect);
ObfDereferenceObjectWithTag(v56, 0x79517350ui64);
return v55;
case 23:
if( (_DWORD)a4 != 8 )
return -1073741820;
v62 = *(VOID **)a3;
v347 = *(VOID **)a3;
if( (unsigned __int8)RtlIsSandboxedToken(InterruptControllerInvalid) )
return -1073741790;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v63 = ObSetProcessDeviceMap((_EPROCESS *)v271, v62, v9);
LABEL_209:
v64 = v63;
v65 = v271;
goto LABEL_210;
case 24:
if( (_DWORD)a4 != 4 )
return -1073741820;
v66 = *(_DWORD *)a3;
v335 = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x204ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
if( v66 != MmGetSessionId((_EPROCESS *)v271) )
v7 = -1073741790;
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return v7;
case 25:
if( (_DWORD)a4 != 1 )
return -1073741820;
v24 = *(_BYTE *)a3;
Alignment_4 = *(_BYTE *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
LOBYTE(v7) = v24 != 0;
PsSetProcessPriorityByClass((_EPROCESS *)v271, (_PSPROCESSPRIORITYMODE)v7);
goto LABEL_89;
case 29:
if( (_DWORD)a4 != 4 )
return -1073741820;
v67 = *(_DWORD *)a3;
v316 = *(_DWORD *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) )
return -1073741727;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
if( v67 )
_InterlockedOr((volatile signed __int32 *)v271 + 281, 0x2000u);
else
_InterlockedAnd((volatile signed __int32 *)v271 + 281, 0xFFFFDFFF);
goto LABEL_89;
case 31:
if( (_DWORD)a4 != 4 )
return -1073741820;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
v13 = result;
if( result < 0 )
return result;
v61 = *(_DWORD *)v5;
v302 = *(_DWORD *)v5;
if( v13 < 0 )
goto LABEL_142;
if( (v61 & 0xFFFFFFFE) != 0 )
goto LABEL_133;
if( (v61 & 1) != 0 )
_InterlockedAnd((volatile signed __int32 *)v271 + 281, 0xFFFFFFFD);
else
_InterlockedOr((volatile signed __int32 *)v271 + 281, 2u);
goto LABEL_142;
case 32:
v298 = 0i64;
if( !(_DWORD)a4 )
goto LABEL_231;
if( (((_DWORD)a4 - 4) & 0xFFFFFFFB) != 0 )
return -1073741820;
v68 = *(_DWORD *)a3;
LODWORD(v298) = *(_DWORD *)a3;
if( (_DWORD)a4 == 8 )
HIDWORD(v298) = *(_DWORD *)(a3 + 4);
else
HIDWORD(v298) = 0;
if( v68 )
return -1073741811;
LABEL_231:
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v167 = v4 == 0;
v69 = v271;
if( v167 )
v70 = 0i64;
else
v70 = (PROCESS_HANDLE_TRACING_ENABLE_EX *)&v298;
v71 = PsSetProcessHandleTracingInformation((_EX_RUNDOWN_REF *)v271, v70);
goto LABEL_236;
case 33:
if( (((_DWORD)a4 - 4) & 0xFFFFFFFB) != 0 )
return -1073741820;
if( (_DWORD)a4 == 4 )
{
v73 = *(_DWORD *)a3;
TargetPriority = *(_DWORD *)a3;
LOBYTE(v74) = 0;
}
else
{
v324 = *(_QWORD *)a3;
v73 = v324;
v74 = HIDWORD(v324);
TargetPriority = (int)v324;
}
if( v73 >= 4 )
return -1073741811;
if( v73 >= 3 && !SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege, (VOID *)a1, 0x200ui64, v9) )
return -1073741727;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
v75 = result;
if( result < 0 )
return result;
v76 = (_EPROCESS *)v271;
RunRef = (_EX_RUNDOWN_REF *)((char *)v271 + 1112);
if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)v271 + 139) )
{
v77 = CurrentThread;
PspLockProcessExclusive(v76, CurrentThread);
bf_0 = v76->$1F247424BFCF625481CFD4988DD60FD2::_bf_0;
v79 = TargetPriority << 27;
do
{
v80 = bf_0;
bf_0 = _InterlockedCompareExchange((volatile signed __int32 *)&v76->1124, v79 | bf_0 & 0xC7FFFFFF, bf_0);
}
while( bf_0 != v80 );
v81 = (_EPROCESS *)v271;
v82 = (_LIST_ENTRY *)*((_QWORD *)v271 + 188);
if( v82 != (_LIST_ENTRY *)((char *)v271 + 1504) )
{
v83 = TargetPriority;
do
{
if( (_BYTE)v74 == 1 && (signed int)((LODWORD(v82[2].Blink) >> 9) & 7) < v83 )
IoBoostThreadIoPriority((_ETHREAD *)&v82[-79].Blink, (_IO_PRIORITY_HINT)v83, 0i64);
PsSetIoPriorityThread((_ETHREAD *)&v82[-79].Blink, (_IO_PRIORITY_HINT)v83);
v82 = v82->Flink;
}
while( v82 != &v81->ThreadListHead );
}
PspUnlockProcessExclusive(v81, v77);
ExReleaseRundownProtection(RunRef);
ObfDereferenceObjectWithTag(v81, 0x79517350ui64);
return v75;
}
else
{
LABEL_247:
ObfDereferenceObjectWithTag(v76, 0x79517350ui64);
return -1073741558;
}
case 34:
if( (_DWORD)a4 != 4 )
return -1073741820;
if( a1 != -1i64 )
return -1073741811;
v84 = *(_DWORD *)a3;
CurrentProcess = (_EPROCESS *)PsGetCurrentProcess();
KeSetExecuteOptions(CurrentProcess, v84);
v72 = v86;
if( v86 < 0 || (v84 & 3) != 1 )
return v72;
MmRemoveExecuteGrants();
return v72;
case 35:
memset(P, 0, sizeof(P));
v354 = 0i64;
v272 = 0;
v288 = 0i64;
v293 = 0i64;
if( a1 != -1i64 )
return -1073741811;
if( v9 != 1 )
return -1073741823;
if( (unsigned int)a4 < 0x28 )
return -1073741820;
v98 = (unsigned int)(a4 - 16) / 0x18ui64;
if( (unsigned int)(a4 - 16) % 0x18ui64 )
return -1073741820;
if( (_DWORD)a4 == 40 )
{
PoolWithQuotaTag = P;
CurrentThread = (_ETHREAD *)P;
}
else
{
PoolWithQuotaTag = (__int128 *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, (unsigned int)a4, 0x736C5450ui64);
CurrentThread = (_ETHREAD *)PoolWithQuotaTag;
if( !PoolWithQuotaTag )
return -1073741670;
}
v325 = PoolWithQuotaTag;
RunRef = (_EX_RUNDOWN_REF *)PoolWithQuotaTag;
memmove(PoolWithQuotaTag, (const VOID *)v5, v4);
if( *((_DWORD *)PoolWithQuotaTag + 1) < 2u
&& (v100 = *(_DWORD *)PoolWithQuotaTag, (*(_DWORD *)PoolWithQuotaTag & 0xFFFFFFFE) == 0)
&& (v101 = *((unsigned int *)PoolWithQuotaTag + 2), (_DWORD)v101)
&& v98 == v101 )
{
v102 = 0;
v272 = 0;
v103 = PoolWithQuotaTag + 1;
do
{
if( *v103 )
goto LABEL_331;
v272 = ++v102;
v103 += 6;
}
while( v102 < (unsigned int)v101 );
v104 = (_EPROCESS *)PsGetCurrentProcess();
v271 = v104;
v278 = 0;
if( (v100 & 1) != 0 )
{
WoW64Process = v104->WoW64Process;
if( !WoW64Process || (Machine = WoW64Process->Machine, Machine != 332) && Machine != 452 )
{
LABEL_331:
v13 = -1073741811;
goto LABEL_333;
}
v278 = 1;
}
v107 = v278 ^ 1u;
Alignment = 4 * v107 + 4;
v299 = 4 * v107 + 4;
v289 = v5;
v272 = 0;
v13 = 0;
v273 = 0;
for( j = 0i64; ; j = *(_ETHREAD **)Handle )
{
*(_QWORD *)Handle = PsGetNextProcessThread((_EPROCESS *)v271, j);
v109 = *(_QWORD **)Handle;
if( !*(_QWORD *)Handle || v272 >= *((_DWORD *)PoolWithQuotaTag + 2) )
break;
if( (*(_DWORD *)(*(_QWORD *)Handle + 116i64) & 0x400) == 0
&& ExAcquireRundownProtection((_EX_RUNDOWN_REF *)(*(_QWORD *)Handle + 1272i64)) )
{
v110 = v109[30];
v312 = v110;
if( v278 )
{
v111 = (char *)(v110 + 8236);
v293 = v110 + 8236;
v112 = (char *)PtrToUlong((VOID *)*(unsigned int *)(v110 + 8236));
}
else
{
v111 = (char *)(v110 + 88);
v293 = v110 + 88;
v112 = *(char **)(v110 + 88);
}
v288 = v112;
if( v112 )
{
if( *((_DWORD *)PoolWithQuotaTag + 1) == 1 )
{
if( v112 == v111 )
{
v288 = 0i64;
}
else
{
v113 = *((unsigned int *)PoolWithQuotaTag + 3);
v114 = v299 * v113;
if( v299 * v113 )
{
if( ((Alignment - 1) & (unsigned int)v112) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v112[v114] > 0x7FFFFFFF0000i64 || &v112[v114] < v112 )
{
MEMORY[0x7FFFFFFF0000] = 0;
v113 = *((unsigned int *)v325 + 3);
}
}
v115 = (UINT64 *)PoolWithQuotaTag + 3 * v272 + 3;
ProbeForWrite(*v115, v299 * v113, Alignment);
memmove((VOID *)*v115, v112, v299 * *((_DWORD *)PoolWithQuotaTag + 3));
_InterlockedOr(&v266, 0);
v110 = v312;
}
v116 = v272;
*(_DWORD *)(v289 + 24i64 * v272 + 16) |= 1u;
Ptr = RunRef[3 * v116 + 3].Ptr;
if( v278 )
*(_DWORD *)(v110 + 8236) = PtrToUlong(Ptr);
else
*(_QWORD *)(v110 + 88) = Ptr;
v118 = v289 + 24i64 * v272;
*(_QWORD *)(v118 + 32) = *(_QWORD *)(*(_QWORD *)Handle + 1152i64);
*(_QWORD *)(v118 + 24) = v288;
*(_DWORD *)(v118 + 16) ^= 3u;
++v272;
}
else
{
v119 = 24i64 * v272;
*(_DWORD *)(v119 + v289 + 16) |= 1u;
Ptr_high = HIDWORD(RunRef[1].Ptr);
if( v278 )
{
v121 = (unsigned __int64)&v112[4 * Ptr_high];
if( v121 >= 0x7FFFFFFF0000i64 )
v121 = 0x7FFFFFFF0000i64;
v122 = PtrToUlong((VOID *)*(unsigned int *)v121);
v293 = v122;
v123 = PtrToUlong(*(VOID **)((char *)PoolWithQuotaTag + v119 + 24));
v124 = (unsigned __int64)&v288[4 * *((unsigned int *)PoolWithQuotaTag + 3)];
if( v124 >= 0x7FFFFFFF0000i64 )
v124 = 0x7FFFFFFF0000i64;
*(_DWORD *)v124 = v123;
}
else
{
v125 = (unsigned __int64)&v112[8 * Ptr_high];
if( v125 >= 0x7FFFFFFF0000i64 )
v125 = 0x7FFFFFFF0000i64;
v122 = *(_QWORD *)v125;
v293 = *(_QWORD *)v125;
v126 = (unsigned __int64)&v288[8 * *((unsigned int *)PoolWithQuotaTag + 3)];
if( v126 >= 0x7FFFFFFF0000i64 )
v126 = 0x7FFFFFFF0000i64;
*(_QWORD *)v126 = *(_QWORD *)((char *)PoolWithQuotaTag + v119 + 24);
}
v127 = 3i64 * v272;
v128 = v289;
*(_QWORD *)(v289 + 8 * v127 + 24) = v122;
*(_DWORD *)(v128 + 8 * v127 + 16) ^= 3u;
++v272;
}
}
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)(*(_QWORD *)Handle + 1272i64));
}
}
if( *(_QWORD *)Handle )
PsQuitNextProcessThread(*(_ETHREAD **)Handle);
}
else
{
v13 = -1073741820;
}
LABEL_333:
if( PoolWithQuotaTag == P )
return v13;
ExFreePoolWithTag(PoolWithQuotaTag, 0);
return v13;
case 39:
if( (_DWORD)a4 != 4 )
return -1073741820;
PagePriority = *(_DWORD *)a3;
v87 = PagePriority;
if( PagePriority > MmGetDefaultPagePriority() || PagePriority < MiCreateSystemWsles() )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
v88 = result;
if( result < 0 )
return result;
v76 = (_EPROCESS *)v271;
v89 = (_EX_RUNDOWN_REF *)((char *)v271 + 1112);
if( !ExAcquireRundownProtection((_EX_RUNDOWN_REF *)v271 + 139) )
goto LABEL_247;
v90 = CurrentThread;
PspLockProcessExclusive(v76, CurrentThread);
v91 = v87 << 12;
v92 = v76->$4E3DFAFA17165B33969DFF4E60E4EB31::_bf_0;
do
{
v93 = v92;
v92 = _InterlockedCompareExchange((volatile signed __int32 *)&v76->1120, v91 | v92 & 0xFFFF8FFF, v92);
}
while( v92 != v93 );
v94 = (_EPROCESS *)v271;
v95 = (char *)v271 + 1504;
v96 = (char *)*((_QWORD *)v271 + 188);
if( v96 != (char *)v271 + 1504 )
{
v97 = PagePriority;
do
{
PsSetPagePriorityThread((_ETHREAD *)(v96 - 1256), v97);
v96 = *(char **)v96;
}
while( v96 != v95 );
}
PspUnlockProcessExclusive(v94, v90);
ExReleaseRundownProtection(v89);
ObfDereferenceObjectWithTag(v94, 0x79517350ui64);
return v88;
case 40:
memset(&ApcState, 0, sizeof(ApcState));
if( (((_DWORD)a4 - 8) & 0xFFFFFFF7) != 0 )
return -1073741820;
if( (_DWORD)a4 == 8 )
{
*(_QWORD *)&v300 = 0i64;
v129 = *(_QWORD *)a3;
*((_QWORD *)&v300 + 1) = *(_QWORD *)a3;
}
else
{
v300 = *(_OWORD *)a3;
v129 = *((_QWORD *)&v300 + 1);
}
if( DWORD1(v300) )
return -1073741811;
if( (_DWORD)v300 != DWORD1(v300) )
return -1073741736;
if( v129 != (__int64)(v129 << 16) >> 16 )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v130 = (_EPROCESS *)PsGetCurrentProcess();
v131 = SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9);
v56 = (_EPROCESS *)v271;
if( !v131 && v271 != v130 )
{
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return -1073741727;
}
if( !ExAcquireRundownProtection((_EX_RUNDOWN_REF *)v271 + 139) )
{
LABEL_194:
ObfDereferenceObjectWithTag(v56, 0x79517350ui64);
return -1073741558;
}
v132 = v56->WoW64Process;
v134 = 0;
if( v132 )
{
v133 = v132->Machine;
if( v133 == 332 || v133 == 452 )
v134 = 1;
}
v135 = v130->WoW64Process;
if( v134 )
{
if( v135 )
{
v139 = v135->Machine;
if( v139 == 332 || v139 == 452 )
{
KeStackAttachProcess(&v56->Pcb, &ApcState);
if( v129 < (unsigned __int64)MmGetMaximumUserAddress() && MmValidateUserCallTarget((VOID *)v129) )
{
Peb = 0i64;
v141 = v56->WoW64Process;
if( v141 )
Peb = v141->Peb;
Peb[290] = DWORD2(v300);
KeUnstackDetachProcess(&ApcState);
}
else
{
v7 = -1073741811;
KeUnstackDetachProcess(&ApcState);
}
LABEL_378:
ExReleaseRundownProtection(&v56->RundownProtect);
LABEL_379:
ObfDereferenceObjectWithTag(v56, 0x79517350ui64);
return v7;
}
}
}
else if( !v135 || (v136 = v135->Machine, v136 != 332) && v136 != 452 )
{
KeStackAttachProcess(&v56->Pcb, &ApcState);
if( !MmValidateUserCallTarget((VOID *)v129) )
v7 = -1073741811;
KeUnstackDetachProcess(&ApcState);
if( v7 >= 0 )
{
v137 = CurrentThread;
PspLockProcessExclusive(v56, CurrentThread);
v56->Pcb.InstrumentationCallback = (void *)v129;
v138 = v56->ThreadListHead.Flink;
if( v138 != &v56->ThreadListHead )
{
while( 1 )
{
if( v129 )
_interlockedbittestandset((volatile signed __int32 *)&v138[-79].Blink, 0x19u);
else
_interlockedbittestandreset((volatile signed __int32 *)&v138[-79].Blink, 0x19u);
v138 = v138->Flink;
if( v138 == &v56->ThreadListHead )
break;
v129 = *((_QWORD *)&v300 + 1);
}
v56 = (_EPROCESS *)v271;
}
PspUnlockProcessExclusive(v56, v137);
}
goto LABEL_378;
}
v7 = -1073741637;
goto LABEL_378;
case 41:
v336 = 0i64;
v337 = 0i64;
v338 = 0i64;
if( a1 != -1i64 )
return -1073741811;
v142 = 0i64;
if( (_DWORD)a4 == 40 )
{
if( v9 )
{
v336 = *(_OWORD *)a3;
v337 = *(_OWORD *)(a3 + 16);
v338 = *(_QWORD *)(a3 + 32);
v142 = (_QWORD *)(a3 + 32);
v5 = (__int64)&v336;
}
v143 = *(_DWORD *)v5;
if( *(_DWORD *)v5 > 0x40u || *(_DWORD *)(v5 + 4) | *(_DWORD *)(v5 + 8) | *(_DWORD *)(v5 + 12) )
return -1073741811;
v5 += 16i64;
}
else
{
if( (_DWORD)a4 != 24 )
return -1073741820;
v143 = 0;
if( v9 )
{
v337 = *(_OWORD *)a3;
v142 = (_QWORD *)(a3 + 16);
v5 = (__int64)&v337;
}
}
if( !*(_QWORD *)v5 )
return -1073741811;
v327 = *(_QWORD *)v5;
*(_QWORD *)(v5 + 16) = 0i64;
result = MmAllocateUserStack((INT64 *)(v5 + 16), *(_QWORD *)(v5 + 8), &v327, v143, 0);
if( result >= 0 && v9 )
*v142 = *(_QWORD *)(v5 + 16);
return result;
case 45:
if( a1 != -1i64 )
return -1073741811;
if( (_DWORD)a4 != 4 )
return -1073741820;
PagePriority_4 = *(_DWORD *)a3;
if( (PagePriority_4 & 0xFFFFFFFC) != 0 )
return -1073741811;
return PspSetProcessAffinityUpdateMode(v8, (PROCESS_AFFINITY_UPDATE_MODE *)&PagePriority_4);
case 46:
if( (_DWORD)a4 != 4 )
return -1073741820;
v317 = *(_DWORD *)a3;
v144 = v317;
if( (v317 & 0xFFFFFFFE) != 0 )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
if( (v144 & 1) != 0 )
_InterlockedOr((volatile signed __int32 *)v271 + 281, 0x200000u);
else
_InterlockedAnd((volatile signed __int32 *)v271 + 281, 0xFFDFFFFF);
goto LABEL_89;
case 48:
if( (_DWORD)a4 != 4 )
return -1073741820;
v145 = *(_DWORD *)a3;
v318 = *(_DWORD *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v146 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken((_EPROCESS *)v271);
SeSetVirtualizationToken(v146, v145);
HalPutDmaAdapter(v146);
goto LABEL_89;
case 49:
if( (_DWORD)a4 != 8 )
return -1073741820;
if( a1 != -1i64 || (*(_QWORD *)a3 & 3) != 1 )
return -1073741811;
v147 = *(_QWORD *)a3;
PsGetCurrentProcess()[1].AffinityPadding[3] = v147;
return 0;
case 52:
v275 = 0;
if( (_DWORD)a4 != 8 )
return -1073741820;
v276 = *(VOID **)a3;
if( a1 != -1i64 && (_DWORD)v276 != 2 )
return -1073741811;
break;
case 53:
if( a1 != -1i64 )
return -1073741811;
if( (_DWORD)a4 != 16 )
return -1073741820;
*(_OWORD *)DynamicTable = *(_OWORD *)a3;
if( LOBYTE(DynamicTable[1]) )
return RtlRemoveDynamicFunctionTable(
DynamicTable[0],
rdx0,
0x140000000ui64,
a4,
*(INT64 *)Tag,
(INT64)Object,
(INT64)HandleInformation,
v270);
else
return RtlInsertDynamicFunctionTable(
DynamicTable[0],
rdx0,
0x140000000ui64,
a4,
*(INT64 *)Tag,
(INT64)Object,
(INT64)HandleInformation,
v270);
case 54:
if( (_DWORD)a4 != 4 )
return -1073741820;
v319 = *(_DWORD *)a3;
v210 = v319;
if( (v319 & 0xFFFFFFFE) != 0 )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result >= 0 )
{
v211 = (_EPROCESS *)v271;
v212 = ObReferenceProcessHandleTable((_EPROCESS *)v271);
if( v212 )
{
ExEnableHandleExceptions(v212, v210 & 1);
ObDereferenceProcessHandleTable(v211);
}
else
{
v7 = -1073741558;
}
ObfDereferenceObjectWithTag(v211, 0x79517350ui64);
return v7;
}
return result;
case 56:
*(_OWORD *)Src = 0i64;
v213 = 0i64;
v311 = 0i64;
if( v9 != 1 )
goto LABEL_791;
if( a3 >= 0x7FFFFFFF0000i64 )
v5 = 0x7FFFFFFF0000i64;
v214 = *(_DWORD *)v5;
LODWORD(Src[0]) = v214;
v215 = *(VOID **)(v5 + 8);
Src[1] = v215;
if( !(_WORD)v214 )
return -1073741811;
if( ((unsigned __int8)v215 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v216 = (unsigned __int64)v215 + (unsigned __int16)v214;
if( v216 > 0x7FFFFFFF0000i64 || v216 < (unsigned __int64)v215 )
MEMORY[0x7FFFFFFF0000] = 0;
v217 = ExAllocatePoolWithTag(0x200ui64, LOWORD(Src[0]), 1850307408i64);
v213 = v217;
v311 = v217;
if( !v217 )
return -1073741670;
memmove(v217, Src[1], LOWORD(Src[0]));
Src[1] = v213;
v5 = (__int64)Src;
v348 = Src;
LABEL_791:
Tag[0] = 2035381072;
v13 = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( v13 >= 0 )
{
v218 = v271;
v219 = IoRevokeHandlesForProcess((_UNICODE_STRING *)v5, (_EPROCESS *)v271);
if( v213 )
ExFreePoolWithTag(v213, 0);
ObfDereferenceObjectWithTag(v218, 0x79517350ui64);
return v219;
}
else
{
if( !v213 )
return v13;
ExFreePoolWithTag(v213, 0);
return v13;
}
case 57:
return MmProcessWorkingSetControl((VOID *)a1, (VOID *)a3, (unsigned int)a4, v9);
case 59:
if( (_DWORD)a4 != 4 )
return -1073741820;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v220 = *(_DWORD *)v5 != 0;
v328 = *(_DWORD *)v5 != 0;
v221 = (_EPROCESS *)PsGetCurrentProcess();
v149 = (_EPROCESS *)v271;
if( v221 == v271 )
goto LABEL_169;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) )
{
ObfDereferenceObjectWithTag(v149, 0x79517350ui64);
return -1073741727;
}
v13 = 0;
KeSetCheckStackExtentsProcess(&v149->Pcb, v220);
if( !v220 && (v149->Flags2 & 0x20000) != 0 )
{
_InterlockedAnd((volatile signed __int32 *)&v149->1120, 0xFFFDFFFF);
v149 = (_EPROCESS *)v271;
}
goto LABEL_766;
case 62:
if( (_DWORD)a4 != 16 )
return -1073741820;
v351 = *(_OWORD *)a3;
if( (_WORD)v351 != 1 || DWORD1(v351) )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
if( *((_QWORD *)&v351 + 1) )
_InterlockedOr((volatile signed __int32 *)v271 + 281, 0x100u);
else
_InterlockedAnd((volatile signed __int32 *)v271 + 281, 0xFFFFFEFF);
goto LABEL_89;
case 63:
a2 = 0i64;
if( (_DWORD)a4 != 8 )
return -1073741820;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
a2 = *(_QWORD *)v5;
v63 = PsSetProcessFaultInformation((ULONG_PTR)v271, (PROCESS_FAULT_INFORMATION *)&a2);
goto LABEL_209;
case 65:
if( (_DWORD)a4 != 32 )
return -1073741820;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2001ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v340 = *(__m256i *)v5;
if( v340.m256i_i32[0] != 3 )
{
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return -1073741735;
}
if( (v340.m256i_i32[1] & 0xFFFFFFF8) != 0
|| *(_OWORD *)&v340.m256i_u64[1] != 0i64
|| ((((unsigned __int32)v340.m256i_i32[1] >> 1) & 1) != 0 || (v340.m256i_i8[4] & 4) != 0)
&& (v340.m256i_i8[4] & 1) == 0 )
{
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return -1073741811;
}
if( (((unsigned __int32)v340.m256i_i32[1] >> 1) & 1) != 0 || (v340.m256i_i8[4] & 4) != 0 )
{
v69 = v271;
MmReleaseCommitForMemResetPages((_EPROCESS *)v271, ((unsigned __int32)v340.m256i_i32[1] >> 2) & 1);
}
else
{
v69 = v271;
v71 = MmSetCommitReleaseEligibility((_EPROCESS *)v271, v340.m256i_i8[4] & 1);
}
LABEL_236:
v72 = v71;
ObfDereferenceObjectWithTag(v69, 0x79517350ui64);
return v72;
case 66:
case 67:
if( (a4 & 7) != 0 || (unsigned int)a4 > 0xA0 )
return -1073741820;
memmove(CpuSetMasks, (const VOID *)a3, a4);
v222 = v4 >> 3;
v223 = Alignment;
if( Alignment == 67 )
{
result = ExCpuSetResourceManagerAccessCheck(v9);
if( result < 0 )
return result;
}
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
LOBYTE(v7) = v223 == 67;
KeSetCpuSetsProcess((_EPROCESS *)v271, v222, CpuSetMasks, (unsigned int)v7);
goto LABEL_209;
case 68:
if( (PsGetCurrentProcess()[1].IdealProcessorPadding[10] & 0x100) == 0 )
return -1073741727;
v305 = 0i64;
result = ObReferenceObjectByHandle((VOID *)a1, 0x200ui64, (_OBJECT_TYPE *)PsProcessType, v9, &v305, 0i64);
v225 = result;
if( result >= 0 )
{
_InterlockedOr((volatile signed __int32 *)v305 + 543, 0x40u);
HalPutDmaAdapter((PADAPTER_OBJECT)v305);
return v225;
}
return result;
case 70:
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
_InterlockedOr((volatile signed __int32 *)v271 + 280, 0x80000000);
goto LABEL_89;
case 71:
if( (_DWORD)a4 != 4 )
return -1073741820;
v226 = *(_DWORD *)a3;
v321 = *(_DWORD *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v56 = (_EPROCESS *)v271;
v227 = ObReferenceProcessHandleTable((_EPROCESS *)v271);
if( v227 )
{
ExEnableRaiseUMExceptionOnInvalidHandleClose(v227, v226);
ObDereferenceProcessHandleTable(v56);
}
else
{
v7 = -1073741558;
}
goto LABEL_379;
case 72:
return PsIumEnableOnDemandDebugWithResponse((VOID *)a1, (const VOID *)a3, (unsigned int)a4);
case 74:
if( (_DWORD)a4 != 1 )
return -1073741820;
v228 = *(_BYTE *)a3;
Alignment_7 = *(_BYTE *)a3;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
if( v228 )
_InterlockedOr((volatile signed __int32 *)v271 + 543, 0x200u);
else
_InterlockedAnd((volatile signed __int32 *)v271 + 543, 0xFFFFFDFF);
goto LABEL_89;
case 77:
v349 = 0i64;
v350 = 0;
if( (_DWORD)a4 != 12 )
return -1073741820;
v349 = *(VOID **)a3;
v229 = *(_DWORD *)(a3 + 8);
v350 = v229;
if( (_DWORD)v349 != 1 || (HIDWORD(v349) & 0xFFFFFFFC) != 0 || (~HIDWORD(v349) & v229) != 0 )
return -1073741811;
ExtensionTable = (__int64(__fastcall **)(PVOID, VOID **))ExGetExtensionTable((_EX_HOST *)PspBamExtensionHost);
if( !ExtensionTable )
return -1073741822;
Tag[0] = 2035381072;
v231 = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( v231 >= 0 )
{
v231 = ExtensionTable[1](v271, &v349);
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
}
ExReleaseExtensionTable(PspBamExtensionHost);
return v231;
case 80:
result = ExCpuSetResourceManagerAccessCheck(v9);
if( result < 0 )
return result;
if( v4 != 1 )
return -1073741820;
v224 = *(_BYTE *)v5;
Alignment_6 = *(_BYTE *)v5;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
if( v224 )
_InterlockedOr((volatile signed __int32 *)v271 + 280, 0x8000000u);
else
_InterlockedAnd((volatile signed __int32 *)v271 + 280, 0xF7FFFFFF);
KeRecomputeCpuSetAffinityProcess((INT64)v271);
goto LABEL_89;
case 82:
if( (unsigned int)a4 < 8 )
return -1073741820;
memset(v355, 0, sizeof(v355));
v232 = 144;
if( (unsigned int)a4 < 0x90 )
v232 = a4;
memmove(v355, (const VOID *)a3, v232);
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v233 = v271;
v234 = PoSetProcessEnergyTrackingState((_EPROCESS *)v271, v355);
v17 = v233;
if( v234 >= 0 )
goto LABEL_90;
ObfDereferenceObjectWithTag(v233, 0x79517350ui64);
return v234;
case 83:
return -1073741637;
case 85:
if( (_DWORD)a4 != 24 )
return -1073741820;
*(_OWORD *)pszDest = 0i64;
v358 = 0i64;
v359 = 0i64;
v360 = 0i64;
v361 = 0;
v235 = *(_OWORD *)a3;
*(_OWORD *)v329 = v235;
v330 = *(_QWORD *)(a3 + 16);
if( (unsigned __int64)(v235 + 65) > 0x7FFFFFFF0000i64 || (__int64)v235 + 65 < (unsigned __int64)v235 )
MEMORY[0x7FFFFFFF0000] = 0;
RtlStringCbCopyA(pszDest, 0x41ui64, (INT8 *)v235);
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x220ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v329[0] = (INT64)pszDest;
v361 = 0;
v13 = EtwSetProcessTelemetryCoverage((_EPROCESS *)v271, (INT64)v329);
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
*(_DWORD *)(v5 + 12) = HIDWORD(v329[1]);
*(_DWORD *)(v5 + 16) = v330;
return v13;
case 87:
case 96:
if( (_DWORD)rdx0 == 87 && !(_DWORD)a4 || (_DWORD)rdx0 == 96 && (unsigned int)a4 < 4 )
return -1073741820;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
{
return -1073741727;
}
v281 = 0;
if( Alignment == 87 )
v236 = (*(_BYTE *)v5 & 1 ^ *(_BYTE *)v5) & 2 ^ *(_BYTE *)v5 & 1;
else
v236 = *(_DWORD *)v5;
v281 = v236;
if( (v236 & 0xFFFFFFF0) != 0 )
return -1073741811;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
v237 = (volatile signed __int32 *)v271;
_InterlockedAnd((volatile signed __int32 *)v271 + 543, 0xFFE7FFFF);
v238 = (((v281 >> 2) & 1) << 19) | 0x100000;
if( (v281 & 8) == 0 )
v238 = ((v281 >> 2) & 1) << 19;
_InterlockedOr(v237 + 543, v238);
v239 = (volatile signed __int32 *)v271;
_InterlockedAnd((volatile signed __int32 *)v271 + 280, 0xFCFFFFFF);
v240 = ((v281 & 1) << 24) | 0x2000000;
if( (v281 & 2) == 0 )
v240 = (v281 & 1) << 24;
_InterlockedOr(v239 + 280, v240);
goto LABEL_89;
case 90:
return SeCodeIntegritySetInformationProcess(a1, (unsigned int)rdx0, (const VOID *)a3, (unsigned int)a4);
case 91:
if( (_DWORD)a4 != 4 )
return -1073741820;
v322 = *(_DWORD *)a3;
v241 = v322;
if( (v322 & 0xFFFFFFFE) != 0 )
return -1073741811;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
PspSetProcessForegroundBackgroundRequest((_EPROCESS *)v271, v241 & 1, 1);
LABEL_89:
v17 = v271;
LABEL_90:
ObfDereferenceObjectWithTag(v17, 0x79517350ui64);
return 0;
case 93:
if( (_DWORD)a4 != 4 )
return -1073741820;
v242 = *(_DWORD *)a3;
v320 = *(_DWORD *)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
v13 = result;
if( result < 0 )
return result;
v243 = (_EPROCESS *)PsGetCurrentProcess();
v149 = (_EPROCESS *)v271;
if( v271 != v243 || !v242 )
{
v13 = -1073741811;
goto LABEL_766;
}
v244 = (void(__fastcall **)(_EPROCESS *, _QWORD))ExGetExtensionTable((_EX_HOST *)PspBamExtensionHost);
if( !v244 )
goto LABEL_766;
v244[5](v149, v242);
ExReleaseExtensionTable(PspBamExtensionHost);
ObfDereferenceObjectWithTag(v149, 0x79517350ui64);
return v13;
case 95:
if( (_DWORD)a4 != 8 )
return -1073741820;
v245 = *(VOID **)a3;
v346 = *(VOID **)a3;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x2000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( result < 0 )
return result;
Tag[0] = 2035381072;
v64 = ObReferenceObjectByHandleWithTag(
v245,
0x1000ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v314,
0i64);
v65 = v271;
if( v64 < 0 )
{
LABEL_210:
ObfDereferenceObjectWithTag(v65, 0x79517350ui64);
return v64;
}
else
{
v246 = PspCombineSecurityDomains(v271, v314);
ObfDereferenceObjectWithTag(v314, 0x79517350ui64);
ObfDereferenceObjectWithTag(v271, 0x79517350ui64);
return v246;
}
case 97:
if( (_DWORD)a4 != 8 )
return -1073741820;
v294 = *(_QWORD *)a3;
if( (v294 & 0xFFFFFFFE) != 0 || a1 != -1i64 )
return -1073741811;
v247 = (_EPROCESS *)PsGetCurrentProcess();
v248 = v247->Peb;
if( !v248 )
return -1073741790;
v249 = 0i64;
v250 = v247->WoW64Process;
if( v250 )
v249 = v250->Peb;
v251 = v294 & 1;
LeapSecondFlags = v248->LeapSecondFlags;
if( (v294 & 1) != 0 )
v253 = LeapSecondFlags | 1;
else
v253 = LeapSecondFlags & 0xFFFFFFFE;
v248->LeapSecondFlags = v253;
if( v249 )
{
v254 = v249[285];
if( v251 )
v255 = v254 | 1;
else
v255 = v254 & 0xFFFFFFFE;
v249[285] = v255;
}
return v7;
case 98:
if( a1 != -1i64 )
return -1073741811;
if( v9 != 1 )
return -1073741823;
if( (_DWORD)a4 != 32 )
return -1073741820;
if( !KeIsUserCetAllowed()
|| (KeGetCurrentThread()->$66B5187701DB455CD8F8862345C5A268::$BF47041B248301F87E570BEB78208C5A::_bf_0 & 0x100000) == 0 )
{
return -1073741637;
}
return PspSetupUserFiberShadowStack(*(_QWORD *)v5, *(_QWORD *)(v5 + 8), *(_OWORD *)(v5 + 16), (_QWORD *)(v5 + 24));
case 99:
if( a1 != -1i64 )
return -1073741811;
if( v9 != 1 )
return -1073741823;
if( (_DWORD)a4 != 8 )
return -1073741820;
if( KeIsUserCetAllowed()
&& (KeGetCurrentThread()->$66B5187701DB455CD8F8862345C5A268::$BF47041B248301F87E570BEB78208C5A::_bf_0 & 0x100000) != 0 )
{
return PspFreeUserFiberShadowStack(*(PVOID *)v5);
}
return -1073741637;
case 100:
if( (_DWORD)a4 != 1 )
return -1073741820;
if( !*(_BYTE *)a3 )
return -1073741811;
if( v9 )
return -1073741790;
v310 = 0i64;
result = ObReferenceObjectByHandle((VOID *)a1, 0xBEAui64, (_OBJECT_TYPE *)PsProcessType, 0, &v310, 0i64);
if( result >= 0 )
{
v256 = PspEnableAltSystemCallHandling((INT64)v310);
HalPutDmaAdapter((PADAPTER_OBJECT)v310);
return v256;
}
return result;
case 101:
v257 = 0i64;
if( (_DWORD)a4 != 16 )
return -1073741820;
*(_OWORD *)Address = *(_OWORD *)a3;
v258 = 16 * LOWORD(Address[0]);
if( !v258 )
return -1073741811;
v259 = Address[1];
if( !Address[1] )
return -1073741811;
v294 = 16 * (unsigned int)LOWORD(Address[0]);
ProbeForWrite((UINT64)Address[1], v258, 8i64);
if( WORD1(Address[0]) || HIDWORD(Address[0]) )
return -1073741811;
if( v9 != 1 )
return -1073741790;
v295 = 0i64;
result = ObReferenceObjectByHandle((VOID *)a1, 0x200ui64, (_OBJECT_TYPE *)PsProcessType, 1, &v295, 0i64);
v260 = (_EPROCESS *)v295;
v271 = v295;
if( result < 0 )
return result;
if( v260 == (_EPROCESS *)PsGetCurrentProcess() && (v260->MitigationFlags2 & 0x40000000) != 0 )
{
v13 = -1073741790;
}
else if( (v260->MitigationFlags2 & 0x4000) != 0 )
{
Pool2 = ExAllocatePool2(257i64, v294, 0x4E484544ui64);
v257 = Pool2;
v295 = Pool2;
if( Pool2 )
{
memmove(Pool2, v259, v294);
HIDWORD(AffinitySet) = 0;
v13 = PspProcessDynamicEHContinuationTargets((ULONG_PTR)v260);
v273 = v13;
v277 = 0;
}
else
{
v13 = -1073741801;
}
}
else
{
v13 = -1073741637;
}
goto LABEL_945;
case 102:
v257 = 0i64;
if( (_DWORD)a4 != 16 )
return -1073741820;
*(_OWORD *)v309 = *(_OWORD *)a3;
v262 = 24 * LOWORD(v309[0]);
if( !v262 )
return -1073741811;
v263 = (const VOID *)v309[1];
if( !v309[1] )
return -1073741811;
v294 = v262;
ProbeForWrite(v309[1], v262, 8i64);
if( WORD1(v309[0]) || HIDWORD(v309[0]) )
return -1073741811;
if( v9 != 1 )
return -1073741790;
v296 = 0i64;
result = ObReferenceObjectByHandle((VOID *)a1, 0x200ui64, (_OBJECT_TYPE *)PsProcessType, 1, &v296, 0i64);
v264 = (_EPROCESS *)v296;
v271 = v296;
if( result < 0 )
return result;
if( v264 == (_EPROCESS *)PsGetCurrentProcess() && (v264->MitigationFlags2 & 0x40000000) != 0 )
{
v13 = -1073741790;
}
else if( (v264->MitigationFlags2 & 0x4000) != 0 )
{
v265 = ExAllocatePool2(257i64, v294, 0x52414544ui64);
v257 = v265;
v296 = v265;
if( v265 )
{
memmove(v265, v263, v294);
LODWORD(a5) = 0;
v13 = PspProcessDynamicEnforcedAddressRanges(
v264,
&v264->DynamicEnforcedCetCompatibleRanges.Tree.Root,
(INT64)v257,
v309[0],
(INT64)&a5);
v273 = v13;
while( 1 )
{
v277 = v7;
if( v7 >= (unsigned int)a5 )
break;
*((_DWORD *)v263 + 6 * (unsigned int)v7 + 4) = v257[6 * v7 + 4];
++v7;
}
}
else
{
v13 = -1073741801;
}
}
else
{
v13 = -1073741637;
}
LABEL_945:
if( v271 )
HalPutDmaAdapter((PADAPTER_OBJECT)v271);
if( v257 )
{
ExFreePoolWithTag(v257, 0);
return v13;
}
return v13;
default:
return -1073741821;
}
v149 = (_EPROCESS *)PsGetCurrentProcess();
v271 = v149;
switch( (int)v276 )
{
case 1:
if( (HIDWORD(v276) & 0xFFFFFFF0) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
v150 = (HIDWORD(v276) >> 1) & 1;
if( !v150 && (v149->MitigationFlags & 0x10) != 0 )
goto LABEL_437;
if( (BYTE4(v276) & 1) == 0 && (v149->MitigationFlags & 0x40) == 0 )
goto LABEL_437;
v151 = (HIDWORD(v276) >> 3) & 1;
if( !v151 && (v149->MitigationFlags & 8) != 0 )
goto LABEL_437;
if( v151 )
{
if( !v150 )
{
v13 = -1073741776;
goto LABEL_765;
}
}
else if( !v150 )
{
LABEL_443:
if( (BYTE4(v276) & 1) != 0 )
{
_InterlockedAnd((volatile signed __int32 *)&v149->2512, 0xFFFFFFBF);
v149 = (_EPROCESS *)v271;
}
if( v151 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 8u);
v149 = (_EPROCESS *)v271;
}
goto LABEL_447;
}
_InterlockedOr((volatile signed __int32 *)&v149->2512, 0x10u);
v149 = (_EPROCESS *)v271;
goto LABEL_443;
case 2:
v156 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFFF0) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) != 0 && (BYTE4(v276) & 8) != 0 )
v156 = HIDWORD(v276) & 0xFFFFFFF7;
v157 = v156 & 1;
if( (v156 & 1) == 0 && ((v156 & 2) != 0 || (v156 & 4) != 0) )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (unsigned int)PsIsSystemWideMitigationOptionSet(v148, 0x140000000ui64) )
{
LABEL_764:
v13 = -1073741637;
goto LABEL_765;
}
if( a1 == -1i64 )
goto LABEL_514;
Tag[0] = 2035381072;
v13 = ObReferenceObjectByHandleWithTag(
(VOID *)a1,
0x200ui64,
(_OBJECT_TYPE *)PsProcessType,
v9,
*(UINT64 *)Tag,
&v271,
0i64);
if( v13 < 0 )
goto LABEL_481;
v275 = 1;
v158 = (_EPROCESS *)PsGetCurrentProcess();
v149 = (_EPROCESS *)v271;
if( v271 == v158 )
{
LABEL_514:
if( (v156 & 1) == 0 && (v149->MitigationFlags & 0x100) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v169 = (v156 >> 3) & 1;
if( !v169 && (v156 & 1) == 0 && (v149->MitigationFlags & 0x800) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v170 = (v156 >> 1) & 1;
if( v170 )
{
MitigationFlags = v149->MitigationFlags;
if( (MitigationFlags & 0x100) != 0 && (MitigationFlags & 0x200) == 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
}
v168 = (v156 >> 2) & 1;
if( v168 )
{
v172 = v149->MitigationFlags;
if( (v172 & 0x100) != 0 && (v172 & 0x400) == 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
}
if( v157 )
{
v173 = 2304;
}
else
{
v173 = 0;
if( v169 )
v173 = 2048;
}
v162 = (v170 ^ 1u) << 9;
v165 = v173 | 0x200;
if( !v170 )
v165 = v173;
p_MitigationFlags = (UINT64 *)&v149->MitigationFlags;
v166 = v165;
LODWORD(v166) = v165 | 0x400;
v167 = v168 == 0;
}
else
{
p_MitigationFlags = (UINT64 *)((char *)v271 + 2512);
v160 = *((_DWORD *)v271 + 628);
if( (v160 & 0x100) != 0 )
{
memset(&SubjectContext, 0, sizeof(SubjectContext));
SeCaptureSubjectContextEx(0i64, (PEPROCESS)v271, &SubjectContext);
v161 = RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)&SubjectContext);
SeReleaseSubjectContext(&SubjectContext);
if( ((unsigned __int8)RtlIsSandboxedToken(InterruptControllerInvalid)
|| !v161
|| (*(_DWORD *)p_MitigationFlags & 0x400) == 0)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) )
{
goto LABEL_437;
}
}
else if( (v156 & 8) == 0 && (v156 & 1) == 0 && (v160 & 0x800) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v162 = 0i64;
if( (v156 & 1) == 0 )
v162 = 2304i64;
v163 = -v157;
v164 = (v163 != 0 ? 0x100 : 0) | 0x800;
if( (v156 & 8) == 0 )
v164 = v163 != 0 ? 0x900 : 0;
if( ((v156 >> 1) & 1) == 0 )
v162 = (unsigned int)v162 | 0x200;
v165 = v164 | 0x200;
if( ((v156 >> 1) & 1) == 0 )
v165 = v164;
v166 = v165;
LODWORD(v166) = v165 | 0x400;
v168 = (v156 >> 2) & 1;
v167 = v168 == 0;
}
if( v167 )
v166 = v165;
if( !v168 )
v162 = (unsigned int)v162 | 0x400;
RtlInterlockedSetClearBits(p_MitigationFlags, v166, v162);
v13 = 0;
goto LABEL_765;
case 3:
if( (HIDWORD(v276) & 0xFFFFFFFC) != 0 )
{
v13 = -1073741811;
}
else if( ((HIDWORD(v276) >> 1) & 1) != 0 || (BYTE4(v276) & 1) == 0 )
{
if( ((HIDWORD(v276) >> 1) & 1) == 0 || (BYTE4(v276) & 1) != 0 )
{
v152 = ObReferenceProcessHandleTable(v149);
if( v152 )
{
v13 = -1073741790;
if( ExEnableHandleExceptions(v152, BYTE4(v276) & 1) )
v13 = 0;
ObDereferenceProcessHandleTable(v149);
}
else
{
v13 = -1073741558;
}
}
else
{
v13 = -1073741811;
}
}
else
{
v13 = -1073741811;
}
goto LABEL_765;
case 4:
v153 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFFFC) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) != 0 && (BYTE4(v276) & 2) != 0 )
{
v153 = HIDWORD(v276) & 0xFFFFFFFD;
HIDWORD(v276) &= ~2u;
}
v154 = v153 & 1;
if( (v153 & 1) == 0 && (v149->MitigationFlags & 0x1000) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v155 = (v153 >> 1) & 1;
if( v155 )
goto LABEL_473;
if( v154 )
goto LABEL_475;
if( (v149->MitigationFlags & 0x2000) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
LABEL_473:
if( !v154 && !v155 )
goto LABEL_477;
LABEL_475:
if( PsIsGuiThread(CurrentThread) )
{
v13 = -1073741431;
}
else
{
LABEL_477:
v13 = 0;
if( v154 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 0x3000u);
v149 = (_EPROCESS *)v271;
}
else if( v155 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 0x2000u);
LABEL_481:
v149 = (_EPROCESS *)v271;
}
}
goto LABEL_765;
case 6:
if( (HIDWORD(v276) & 0xFFFFFFFE) != 0 )
{
v13 = -1073741811;
}
else if( (BYTE4(v276) & 1) != 0 || (v149->MitigationFlags & 0x80u) == 0 )
{
v13 = 0;
if( (BYTE4(v276) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 0x80u);
v149 = (_EPROCESS *)v271;
}
}
else
{
v13 = -1073741790;
}
goto LABEL_765;
case 7:
if( (HIDWORD(v276) & 0xFFFFFFF8) != 0 )
{
v13 = -1073741811;
}
else if( (v149->MitigationFlags & 1) != 0 )
{
if( (BYTE4(v276) & 4) != 0 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 4u);
v13 = 0;
v149 = (_EPROCESS *)v271;
}
else
{
v13 = -1073741790;
}
}
else
{
v13 = -1073741790;
}
goto LABEL_765;
case 8:
v174 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFFE0) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) != 0 && ((BYTE4(v276) & 8) != 0 || (BYTE4(v276) & 0x10) != 0) )
v174 = HIDWORD(v276) & 0xFFFFFFE7;
if( (v174 & 2) != 0 && (v174 & 0x10) != 0 )
v174 &= ~0x10u;
v175 = (v174 >> 3) & 1;
if( v175 && (v174 & 0x10) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
v176 = (v174 >> 1) & 1;
if( (v174 & 1) + v176 > 1 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (v174 & 1) != 0 )
goto LABEL_576;
if( v149->SignatureLevel >= 8u && v149->SectionSignatureLevel >= 8u )
{
v13 = -1073741790;
goto LABEL_765;
}
if( !v176 && SeCompareSigningLevels() && SeCompareSigningLevels() )
{
v13 = -1073741790;
goto LABEL_765;
}
LABEL_576:
if( (v149->MitigationFlags & 0x3000000) != 0 && (v174 & 0x10) == 0 && !v176 && !v175 && (v174 & 1) == 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v13 = 0;
if( (v174 & 1) != 0 )
{
if( v149->SignatureLevel < 8u )
v149->SignatureLevel = 8;
if( v149->SectionSignatureLevel < 8u )
v149->SectionSignatureLevel = 8;
}
else if( v176 )
{
if( !SeCompareSigningLevels() )
{
v13 = -1073741790;
goto LABEL_765;
}
if( SeCompareSigningLevels() )
v149->SectionSignatureLevel = 6;
}
if( v174 )
v7 = 0x800000;
v177 = (unsigned __int8)((v174 & 8) == 0) << 24;
v178 = v7 | 0x1000000;
if( !v175 )
v178 = v7;
v179 = (v174 >> 4) & 1;
if( !v179 )
v177 = (unsigned int)v177 | 0x2000000;
v180 = v178;
LODWORD(v180) = v178 | 0x2000000;
if( !v179 )
v180 = v178;
RtlInterlockedSetClearBits((UINT64 *)&v149->MitigationFlags, v180, v177);
goto LABEL_765;
case 9:
if( (HIDWORD(v276) & 0xFFFFFFFC) != 0 )
{
v13 = -1073741811;
}
else if( (BYTE4(v276) & 1) != 0 || (v149->MitigationFlags & 0x10000) == 0 )
{
if( (BYTE4(v276) & 1) != 0 || (BYTE4(v276) & 2) != 0 || (v149->MitigationFlags & 0x20000) == 0 )
{
v13 = 0;
if( (BYTE4(v276) & 1) != 0 )
{
RtlInterlockedSetClearBits((UINT64 *)&v149->MitigationFlags, 0x10000ui64, 0x20000ui64);
}
else if( (BYTE4(v276) & 2) != 0 )
{
RtlInterlockedSetClearBits((UINT64 *)&v149->MitigationFlags, 0x20000ui64, 0x10000ui64);
}
}
else
{
v13 = -1073741790;
}
}
else
{
v13 = -1073741790;
}
goto LABEL_765;
case 10:
v181 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFFE0) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) != 0 && (BYTE4(v276) & 8) != 0 )
v181 = HIDWORD(v276) & 0xFFFFFFF7;
if( (v181 & 2) != 0 && (v181 & 0x10) != 0 )
v181 &= ~0x10u;
v182 = v181 & 1;
v183 = 0x80000;
if( (v181 & 1) == 0 && (v149->MitigationFlags & 0x80000) != 0 )
goto LABEL_437;
v184 = (v181 >> 1) & 1;
if( !v184 && (v149->MitigationFlags & 0x200000) != 0 )
goto LABEL_437;
v185 = (v181 >> 2) & 1;
if( !v185 && (v149->MitigationFlags & 0x40000) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v186 = (v181 >> 3) & 1;
if( !v186 && (v181 & 1) == 0 && (v149->MitigationFlags & 0x100000) != 0 )
goto LABEL_437;
v187 = (v181 >> 4) & 1;
if( v187 || v184 || (v149->MitigationFlags & 0x400000) == 0 )
{
v188 = 0;
if( v182 )
{
v188 = 0x100000;
}
else
{
v183 = 0;
if( v186 )
v183 = 0x100000;
}
if( v184 )
{
v183 |= 0x200000u;
v188 |= 0x400000u;
}
else if( v187 )
{
v183 |= 0x400000u;
}
v189 = v183;
LODWORD(v189) = v183 | 0x40000;
if( !v185 )
v189 = v183;
RtlInterlockedSetClearBits((UINT64 *)&v149->MitigationFlags, v189, v188);
v13 = 0;
}
else
{
v13 = -1073741790;
}
goto LABEL_765;
case 13:
v190 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFFF8) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) == 0 && (BYTE4(v276) & 4) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) != 0 && (BYTE4(v276) & 2) != 0 )
v190 = HIDWORD(v276) & 0xFFFFFFFD;
NoChildProcessRestrictedPolicy = PspGetNoChildProcessRestrictedPolicy(v149);
v192 = NoChildProcessRestrictedPolicy;
v193 = v190 & 1;
if( (v190 & 1) == 0 && (unsigned int)(NoChildProcessRestrictedPolicy - 1) <= 1 )
{
v13 = -1073741790;
goto LABEL_765;
}
v194 = (v190 >> 2) & 1;
if( v194 && v192 == 1 )
{
v13 = -1073741790;
goto LABEL_765;
}
v195 = (v190 >> 1) & 1;
if( v195 )
goto LABEL_665;
if( v193 )
goto LABEL_666;
if( v192 == 3 )
{
v13 = -1073741790;
goto LABEL_765;
}
LABEL_665:
if( v193 )
{
LABEL_666:
if( v194 )
PspSetNoChildProcessRestrictedPolicy(v149, 2i64);
else
PspSetNoChildProcessRestrictedPolicy(v149, 1i64);
v13 = 0;
}
else
{
if( !v195 )
goto LABEL_447;
PspSetNoChildProcessRestrictedPolicy(v149, 3i64);
v13 = 0;
}
goto LABEL_765;
case 14:
if( (HIDWORD(v276) & 0xFFFFFFF0) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) == 0 && (v149->MitigationFlags & 0x40000000) != 0
|| ((HIDWORD(v276) >> 1) & 1) == 0 && (v149->MitigationFlags & 0x80000000) != 0
|| ((HIDWORD(v276) >> 3) & 1) == 0 && (v149->MitigationFlags2 & 0x2000) != 0 )
{
goto LABEL_437;
}
v200 = (HIDWORD(v276) >> 2) & 1;
if( v200 || (v149->MitigationFlags2 & 0x1000) == 0 )
{
if( (BYTE4(v276) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 0x40000000u);
v149 = (_EPROCESS *)v271;
}
if( ((HIDWORD(v276) >> 1) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2512, 0x80000000);
_InterlockedOr((volatile signed __int32 *)v271 + 543, 0x200000u);
v149 = (_EPROCESS *)v271;
PspWriteProcessSecurityDomain((INT64)v271, _InterlockedIncrement64(&PsNextSecurityDomain), 1i64);
KeSynchronizeSecurityDomain(v201);
}
if( v200 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x1000u);
v149 = (_EPROCESS *)v271;
}
if( ((HIDWORD(v276) >> 3) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x2000u);
v149 = (_EPROCESS *)v271;
}
v13 = 0;
}
else
{
v13 = -1073741790;
}
goto LABEL_765;
case 15:
v202 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFC00) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 0x10) != 0 )
{
v202 = HIDWORD(v276) | 1;
HIDWORD(v276) |= 1u;
}
if( (v202 & 0x200) != 0 )
{
v202 |= 4u;
HIDWORD(v276) = v202;
}
if( (v202 & 0x40) != 0 )
{
v202 |= 0x20u;
HIDWORD(v276) = v202;
}
v203 = (v202 >> 4) & 1;
if( !v203 && (v149->MitigationFlags2 & 0x100000) != 0
|| (v202 & 1) == 0 && (v149->MitigationFlags2 & 0x4000) != 0 )
{
goto LABEL_437;
}
if( (v202 & 1) != 0 && (v149->MitigationFlags2 & 0x4000) == 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v204 = (v202 >> 9) & 1;
if( v204 && (v149->MitigationFlags2 & 0x80000000) == 0 )
goto LABEL_437;
v205 = (v202 >> 2) & 1;
if( !v205 && (v149->MitigationFlags2 & 0x20000) != 0 )
goto LABEL_437;
if( v205 && (v149->MitigationFlags2 & 0x20000) == 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v206 = (v202 >> 6) & 1;
if( !v206 && (v149->MitigationFlags2 & 0x400000) != 0 )
goto LABEL_437;
v207 = (v202 >> 5) & 1;
if( !v207 && (v149->MitigationFlags2 & 0x200000) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
v208 = (v202 >> 8) & 1;
if( !v208 && (v149->MitigationFlags2 & 0x40000000) != 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
if( ((v202 >> 1) & 1) == 0 && (v149->MitigationFlags2 & 0x8000) != 0
|| ((v202 >> 1) & 1) != 0 && (v149->MitigationFlags2 & 0x8000) == 0
|| ((v202 >> 3) & 1) == 0 && (v149->MitigationFlags2 & 0x40000) != 0
|| ((v202 >> 3) & 1) != 0 && (v149->MitigationFlags2 & 0x40000) == 0
|| (v209 = (v202 >> 7) & 1) == 0 && (v149->MitigationFlags2 & 0x800000) != 0 )
{
LABEL_437:
v13 = -1073741790;
goto LABEL_765;
}
if( v209 && (v149->MitigationFlags2 & 0x800000) == 0 )
{
v13 = -1073741790;
goto LABEL_765;
}
if( v203 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x100000u);
v149 = (_EPROCESS *)v271;
}
if( !v204 && v205 )
{
_InterlockedAnd((volatile signed __int32 *)&v149->2516, 0x7FFFFFFFu);
v149 = (_EPROCESS *)v271;
}
if( v206 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x200000u);
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x400000u);
}
else
{
if( !v207 )
goto LABEL_761;
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x200000u);
}
v149 = (_EPROCESS *)v271;
LABEL_761:
if( v208 )
{
_InterlockedOr((volatile signed __int32 *)&v149->2516, 0x40000000u);
v149 = (_EPROCESS *)v271;
}
v13 = 0;
LABEL_765:
if( v275 != 1 )
return v13;
LABEL_766:
ObfDereferenceObjectWithTag(v149, 0x79517350ui64);
return v13;
case 16:
v196 = HIDWORD(v276);
if( (HIDWORD(v276) & 0xFFFFFFFC) != 0 )
{
v13 = -1073741811;
goto LABEL_765;
}
if( (BYTE4(v276) & 1) != 0 && (BYTE4(v276) & 2) != 0 )
v196 = HIDWORD(v276) & 0xFFFFFFFD;
RedirectionTrustPolicy = PspGetRedirectionTrustPolicy(v149);
v198 = v196 & 1;
if( (v196 & 1) == 0 && RedirectionTrustPolicy == 1 )
{
v13 = -1073741790;
goto LABEL_765;
}
v199 = (v196 >> 1) & 1;
if( v199 )
goto LABEL_684;
if( v198 )
goto LABEL_685;
if( RedirectionTrustPolicy == 2 )
{
v13 = -1073741790;
}
else
{
LABEL_684:
if( v198 )
{
LABEL_685:
PspSetRedirectionTrustPolicy(v149, 1i64);
v13 = 0;
}
else if( v199 )
{
PspSetRedirectionTrustPolicy(v149, 2i64);
v13 = 0;
}
else
{
LABEL_447:
v13 = 0;
}
}
goto LABEL_765;
default:
goto LABEL_764;
}
}Referenced by:
No references.