NtSetSystemInformation
NTSTATUS __stdcall NtSetSystemInformation(
_SYSTEM_INFORMATION_CLASS SystemInformationClass,
VOID *SystemInformation,
UINT64 SystemInformationLength){
size_t v3;
unsigned __int64 p_Destination;
_SYSTEM_INFORMATION_CLASS v5;
wchar_t *Buffer;
unsigned int v7;
UINT64 v8;
char PreviousMode;
__int64 v10;
NTSTATUS Driver;
_CRASHDUMP_CONFIGURATION v12;
NTSTATUS v13;
unsigned int v14;
unsigned int v15;
char v16;
UINT64 v17;
unsigned int ActiveProcessorCount;
_KPRCB **v19;
__int64 v20;
_KPRCB *v21;
VOID *v22;
NTSTATUS result;
__int32 v24;
NTSTATUS v25;
_UNICODE_STRING *p_Buffer;
__int64 v27;
_DRIVER_OBJECT *v28;
_UNICODE_STRING *v29;
__int32 v30;
__int32 v31;
__int32 v32;
NTSTATUS v33;
VOID *v34;
__int64 v35;
INT64 v36;
int v37;
__int64 v38;
unsigned int v39;
_ETHREAD *v40;
_ADAPTER_OBJECT *v41;
__int32 v42;
__int32 v43;
__int32 v44;
int v45;
int v46;
int v47;
int v48;
PS_PROTECTION v49;
unsigned int v50;
bool v51;
unsigned __int64 v52;
__int16 v53;
__int64 v54;
__int32 v55;
__int32 v56;
__int32 v57;
int v58;
int v59;
int v60;
int v61;
int v62;
VOID *v63;
__int32 v64;
__int32 v65;
__int32 v66;
int v67;
int v68;
int v69;
int v70;
int v71;
UINT16 v72;
UINT64 *v73;
UINT64 *v74;
size_t v75;
char v76;
__m128i v77;
unsigned __int16 v78;
char *v79;
VOID **PoolWithTag;
wchar_t *v81;
UINT64 *v82;
UINT64 v83;
UINT8 *v84;
_ADAPTER_OBJECT *v85;
_EPROCESS *CurrentProcess;
size_t v87;
VOID *v88;
size_t v89;
UINT64 *v90;
size_t v91;
VOID *v92;
PVOID *Object;
PVOID *Objecta;
UINT64 *HandleInformation;
INT64 NewTimeSynchronization;
INT64 SessionId_4;
INT64 v98;
_UNICODE_STRING Destination;
UINT64 NewTimeAdjustment;
INT64 ImageBaseAddress;
UINT64 a3;
int v103;
PVOID Event;
_ETHREAD *Thread;
__int64 v106;
PVOID Parameters;
_UNICODE_STRING Base;
unsigned int v109;
UINT64 Size;
unsigned int v111;
VOID *v112;
VOID *v113;
VOID *v114;
_UNICODE_STRING v115;
VOID *Src[2];
_UNICODE_STRING v117;
_UNICODE_STRING v118;
__int128 v119;
UINT64 CpuSetMasks[20];
UINT64 v121[20];
char v122[160];
v3 = SystemInformationLength;
p_Destination = (unsigned __int64)SystemInformation;
v5 = SystemInformationClass;
Buffer = 0i64;
LOBYTE(NewTimeSynchronization) = 0;
Destination = 0i64;
v98 = 0i64;
v7 = 1;
v8 = 1i64;
a3 = 0i64;
v106 = 0i64;
ImageBaseAddress = 0i64;
Thread = 0i64;
NewTimeAdjustment = 0i64;
v117 = 0i64;
v118 = 0i64;
v119 = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
if( PreviousMode )
{
v10 = 1i64;
if( SystemInformationClass != SystemErrorPortInformation )
v10 = 3i64;
if( (_DWORD)SystemInformationLength )
{
if( ((unsigned __int64)SystemInformation & v10) != 0 )
ExRaiseDatatypeMisalignment();
*(_QWORD *)&SystemInformationClass = (char *)SystemInformation + (unsigned int)SystemInformationLength;
if( *(_QWORD *)&SystemInformationClass > 0x7FFFFFFF0000ui64
|| *(_QWORD *)&SystemInformationClass < (unsigned __int64)SystemInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
}
Driver = 0;
if( v5 > SystemVerifierFaultsInformation )
{
if( v5 <= SystemHypervisorDetailInformation )
{
if( v5 == SystemHypervisorDetailInformation )
return -1073741637;
if( v5 > SystemProcessorProfileControlArea )
{
v64 = v5 - 130;
if( !v64 )
{
if( (((_DWORD)SystemInformationLength - 16) & 0xFFFFFFE7) == 0 && (_DWORD)SystemInformationLength != 40 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeProfileSingleProcessPrivilege, PreviousMode) )
{
memmove(&v117, (const VOID *)p_Destination, v3);
if( v3 == 32 )
Buffer = v118.Buffer;
Driver = MmCombineIdenticalPages(*(PVOID *)&v117.Length, *(unsigned int *)&v118.Length, (UINT64 *)Buffer);
HIDWORD(NewTimeSynchronization) = Driver;
*(_QWORD *)(p_Destination + 8) = v106;
return Driver;
}
return -1073741727;
}
return -1073741820;
}
v65 = v64 - 1;
if( !v65 )
{
if( PreviousMode )
return -1073741790;
if( (_DWORD)SystemInformationLength == 24 )
{
KeInitializeEntropySystem();
return v13;
}
return -1073741820;
}
v66 = v65 - 1;
if( !v66 )
{
if( (_DWORD)SystemInformationLength == 4 )
{
*(_QWORD *)&Base.Length = 7733364i64;
Base.Buffer = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\condrv";
if( (*(_BYTE *)SystemInformation & 1) != 0 )
{
KeEnterCriticalRegion();
ExAcquirePushLockExclusiveEx(&ExpConDrvLoadLock, 0i64);
Driver = ZwLoadDriver((UINT64 *)&Base.Length, v82, v83, v84, (UINT64)Object);
if( (_InterlockedExchangeAdd64(&ExpConDrvLoadLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&ExpConDrvLoadLock);
KeAbPostRelease(&ExpConDrvLoadLock);
KeLeaveCriticalRegion();
return Driver;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeLoadDriverPrivilege, PreviousMode) )
return ZwUnloadDriver(&Base);
return -1073741727;
}
return -1073741820;
}
v67 = v66 - 2;
if( !v67 )
{
if( (_DWORD)SystemInformationLength == 32 )
return ExHandleSPCall2(*(_SYSTEM_POLICY_INFORMATION **)&SystemInformationClass);
return -1073741820;
}
v68 = v67 - 8;
if( v68 )
{
v69 = v68 - 8;
if( !v69 )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
return -1073741727;
if( !v3 )
{
if( ExBootLoaderMetadata )
_InterlockedExchange((volatile __int32 *)ExBootLoaderMetadata, 0);
return Driver;
}
return -1073741820;
}
v70 = v69 - 1;
if( !v70 )
{
a3 = 19i64;
if( !SeSinglePrivilegeCheck(19i64, PreviousMode) )
return -1073741727;
v75 = v3 - 1;
if( v75 )
{
if( v75 != 3 )
return -1073741820;
v7 = *(_DWORD *)p_Destination;
v111 = *(_DWORD *)p_Destination;
}
else
{
v76 = *(_BYTE *)p_Destination;
if( *(_BYTE *)p_Destination && !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
return -1073741727;
if( !v76 )
v7 = 5;
}
return ExpSetSoftRebootFlags((VOID *)v7, v72, v73, v74, (WCHAR *)Object, HandleInformation);
}
v71 = v70 - 1;
if( !v71 )
{
if( (_DWORD)SystemInformationLength == 8 )
{
if( PreviousMode )
return ExpQueryElamCertInfo(*(VOID **)SystemInformation);
return -1073741811;
}
return -1073741820;
}
if( v71 == 3 )
return CmReconcileAndValidateAllHives();
return -1073741821;
}
if( (_DWORD)SystemInformationLength != 48 )
return -1073741820;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeShutdownPrivilege, PreviousMode) )
return -1073741727;
if( *(&ExBootDevicesRemovedEvent + 216) )
return 0;
v117 = *(_UNICODE_STRING *)p_Destination;
v77 = *(__m128i *)(p_Destination + 16);
v119 = *(_OWORD *)(p_Destination + 32);
*(__m128i *)Src = v77;
v118 = 0i64;
v78 = _mm_cvtsi128_si32(v77);
if( v78 && (v78 & 1) == 0 )
{
if( ((__int64)Src[1] & 1) != 0 )
ExRaiseDatatypeMisalignment();
v79 = (char *)Src[1] + v78;
if( (unsigned __int64)v79 > 0x7FFFFFFF0000i64 || v79 < Src[1] )
MEMORY[0x7FFFFFFF0000] = 0;
PoolWithTag = ExAllocatePoolWithTag(9ui64, v78, 1347639365i64);
v81 = (wchar_t *)PoolWithTag;
if( PoolWithTag )
{
memmove(PoolWithTag, Src[1], v78);
v118.Buffer = v81;
v118.Length = v78;
v118.MaximumLength = v78;
}
}
*(&ExBootDevicesRemovedEvent + 54) = v117;
*(&ExBootDevicesRemovedEvent + 55) = v118;
*(&ExBootDevicesRemovedEvent + 56) = v119;
return 0;
}
if( v5 == SystemProcessorProfileControlArea )
return KeProcessorProfileControlArea(SystemInformation, (unsigned int)SystemInformationLength, PreviousMode);
v55 = v5 - 102;
if( v55 )
{
v56 = v55 - 2;
if( !v56 )
return ExpSetProcessorMicrocodeUpdateInformation(
SystemInformation,
(unsigned int)SystemInformationLength,
PreviousMode);
v57 = v56 - 2;
if( !v57 )
return -1073741821;
v58 = v57 - 3;
if( !v58 )
{
LOBYTE(v8) = PreviousMode;
return SmSetStoreInformation(
*(VOID **)&SystemInformationClass,
SystemInformation,
(unsigned int)SystemInformationLength,
v8);
}
v59 = v58 - 1;
if( !v59 )
return -1073741822;
v60 = v59 - 1;
if( !v60 )
{
if( (_DWORD)SystemInformationLength != 4 )
return -1073741820;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeProfileSingleProcessPrivilege, PreviousMode) )
return -1073741790;
KUSER_SHARED_DATA.AitSamplingValue = *(_DWORD *)p_Destination;
return 0;
}
v61 = v60 - 2;
if( !v61 )
return PsSetCpuQuotaInformation(SystemInformation, (unsigned int)SystemInformationLength, PreviousMode);
v62 = v61 - 13;
if( !v62 )
{
if( PreviousMode )
return -1073741727;
if( (_DWORD)SystemInformationLength == 32 )
return BgkSetBootGraphicsInformation(*(INT64 *)&SystemInformationClass, (INT64)SystemInformation);
return -1073741820;
}
if( v62 != 1 )
return -1073741821;
if( (_DWORD)SystemInformationLength != 16 )
return -1073741820;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeProfileSingleProcessPrivilege, PreviousMode) )
return -1073741727;
v112 = *(VOID **)p_Destination;
Driver = MmScrubMemory(v63, v112, &a3);
HIDWORD(NewTimeSynchronization) = Driver;
*(_QWORD *)(p_Destination + 8) = a3;
return Driver;
}
v50 = 432;
if( (_DWORD)SystemInformationLength != 432 )
return -1073741820;
if( !PreviousMode || (unsigned __int8)ExpCapabilityCheck(&TimeZoneCapability) )
return ExpSetTimeZoneInformation(
(VOID *)p_Destination,
v50,
SystemInformationLength,
v8,
(INT64)Object,
(INT64)HandleInformation,
NewTimeSynchronization,
SessionId_4);
v51 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTimeZonePrivilege, PreviousMode) == 0;
LABEL_220:
if( v51 )
return -1073741727;
return ExpSetTimeZoneInformation(
(VOID *)p_Destination,
v50,
SystemInformationLength,
v8,
(INT64)Object,
(INT64)HandleInformation,
NewTimeSynchronization,
SessionId_4);
}
if( v5 > SystemSecureDumpEncryptionInformation )
{
if( v5 == SystemCodeIntegrityVerificationInformation )
return SeCodeIntegritySetInformation();
if( v5 != SystemWorkloadAllowedCpuSetsInformation )
{
switch( v5 )
{
case SystemLeapSecondInformation:
if( (_DWORD)SystemInformationLength != 8 )
return -1073741820;
if( PreviousMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemtimePrivilege, PreviousMode) )
return -1073741727;
if( PsIsCurrentThreadInServerSilo() )
return -1073741790;
LOBYTE(NewTimeSynchronization) = (unsigned __int8)*(_QWORD *)p_Destination != 0;
result = ExSetLeapSecondEnabled(NewTimeSynchronization);
Driver = result;
if( result >= 0 )
{
**(&ExBootDevicesRemovedEvent + 103) = NewTimeSynchronization;
return Driver;
}
return result;
case SystemFlags2Information:
if( (_DWORD)SystemInformationLength == 4 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
{
v103 = 0;
NtGlobalFlag2 = *(_DWORD *)p_Destination;
*(_DWORD *)p_Destination = NtGlobalFlag2;
return Driver;
}
return -1073741790;
}
return -1073741820;
case SystemFeatureConfigurationInformation:
LOBYTE(SystemInformationLength) = PreviousMode;
return CmUpdateFeatureConfiguration(SystemInformation, v3, SystemInformationLength);
case SystemFeatureUsageSubscriptionInformation:
LOBYTE(SystemInformationLength) = PreviousMode;
return CmUpdateFeatureUsageSubscription(SystemInformation, v3, SystemInformationLength);
}
if( v5 != SystemCodeIntegrityAddDynamicStore && v5 != SystemCodeIntegrityClearDynamicStores )
return -1073741821;
return SeCodeIntegritySetInformation();
}
if( (unsigned int)SystemInformationLength < 8 )
return -1073741820;
v91 = SystemInformationLength - 8;
if( (((_BYTE)SystemInformationLength - 8) & 7) != 0 || v91 > 0xA0 )
return -1073741820;
v92 = *(VOID **)SystemInformation;
memmove(v122, (char *)SystemInformation + 8, v91);
if( (unsigned __int64)v92 >= 2 )
return -1073741811;
Driver = ExCpuSetResourceManagerAccessCheck(PreviousMode);
if( Driver < 0 )
return Driver;
v89 = v91 >> 3;
v90 = (UINT64 *)v122;
}
else
{
switch( v5 )
{
case SystemSecureDumpEncryptionInformation:
if( !(_DWORD)SystemInformationLength )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
return VslProvisionDumpEncryption();
return -1073741727;
}
return -1073741811;
case SystemVmGenerationCountInformation:
if( PreviousMode )
return -1073741790;
if( (_DWORD)SystemInformationLength == 8 )
return KdInitialize(3i64, SystemInformation, &KdpContext);
return -1073741820;
case SystemCodeIntegrityPolicyInformation:
return SeCodeIntegritySetInformation();
}
if( v5 != SystemAllowedCpuSetsInformation )
{
switch( v5 )
{
case SystemInterruptCpuSetsInformation:
if( (_DWORD)SystemInformationLength == 16 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseBasePriorityPrivilege, PreviousMode) )
{
KeIntSteerAssignCpuSetForGsiv(
(unsigned int)*(_OWORD *)p_Destination,
WORD2(*(_QWORD *)p_Destination),
*(_QWORD *)(p_Destination + 8));
return v13;
}
return -1073741727;
}
return -1073741820;
case SystemCpuSetTagInformation:
if( (unsigned int)SystemInformationLength < 8 )
return -1073741820;
v87 = SystemInformationLength - 8;
if( (((_BYTE)SystemInformationLength - 8) & 7) != 0 || v87 > 0xA0 )
return -1073741820;
v88 = *(VOID **)SystemInformation;
v114 = *(VOID **)SystemInformation;
memmove(CpuSetMasks, (char *)SystemInformation + 8, v87);
Driver = ExCpuSetResourceManagerAccessCheck(PreviousMode);
if( Driver >= 0 )
return KeSetTagCpuSets(v87 >> 3, CpuSetMasks, (UINT64)v88);
return Driver;
case SystemWin32WerStartCallout:
if( (_DWORD)SystemInformationLength == 8 )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
return -1073741727;
v113 = *(VOID **)p_Destination;
Parameters = 0i64;
Driver = ObReferenceObjectByHandle(
v113,
0x1000ui64,
(_OBJECT_TYPE *)PsProcessType,
PreviousMode,
&Parameters,
0i64);
if( Driver >= 0 )
{
v85 = (_ADAPTER_OBJECT *)Parameters;
HIDWORD(NewTimeSynchronization) = MmGetSessionIdEx((_EPROCESS *)Parameters);
if( HIDWORD(NewTimeSynchronization) != -1 )
Driver = PsInvokeWin32Callout(
Win32WerStartCallout,
v85,
PsWin32SessionAttachSingle,
(UINT64 *)((char *)&NewTimeSynchronization + 4));
v41 = v85;
goto LABEL_199;
}
}
else
{
if( (_DWORD)SystemInformationLength )
return -1073741820;
Driver = 0;
CurrentProcess = (_EPROCESS *)PsGetCurrentProcess();
HIDWORD(NewTimeSynchronization) = MmGetSessionIdEx(CurrentProcess);
if( HIDWORD(NewTimeSynchronization) != -1 )
return PsInvokeWin32Callout(
Win32WerStartCallout,
CurrentProcess,
PsWin32SessionAttachSingle,
(UINT64 *)((char *)&NewTimeSynchronization + 4));
}
return Driver;
case SystemActivityModerationExeState:
if( (_DWORD)SystemInformationLength != 24 )
return -1073741820;
v117 = *(_UNICODE_STRING *)SystemInformation;
*(_QWORD *)&v118.Length = *((_QWORD *)SystemInformation + 2);
result = VfProbeAndCaptureUnicodeStringBuffer(&v117, PagedPool);
if( result < 0 )
return result;
Driver = PsSetExeModerationState(
(INT64)&v117,
*(unsigned int *)&v118.Length,
*(unsigned int *)(&v118.MaximumLength + 1));
p_Buffer = &v117;
goto LABEL_101;
}
if( v5 != SystemCodeIntegrityUnlockInformation )
{
if( v5 != SystemIntegrityQuotaInformation )
return -1073741821;
if( !(_DWORD)SystemInformationLength )
{
if( !PreviousMode || SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
return VslRelaxQuotas();
return -1073741727;
}
return -1073741811;
}
return SeCodeIntegritySetInformation();
}
if( (SystemInformationLength & 7) != 0 || (unsigned int)SystemInformationLength > 0xA0 )
return -1073741820;
memmove(v121, SystemInformation, SystemInformationLength);
result = ExCpuSetResourceManagerAccessCheck(PreviousMode);
if( result < 0 )
return result;
v89 = v3 >> 3;
v90 = v121;
}
return KeSetSystemAllowedCpuSets(v89, v90);
}
if( v5 == SystemVerifierFaultsInformation )
{
if( (_DWORD)SystemInformationLength != 40 )
return -1073741820;
if( PreviousMode )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
return -1073741727;
v117 = *(_UNICODE_STRING *)p_Destination;
v118 = *(_UNICODE_STRING *)(p_Destination + 16);
*(_QWORD *)&v119 = *(_QWORD *)(p_Destination + 32);
result = VfProbeAndCaptureUnicodeStringBuffer((_UNICODE_STRING *)&v117.Buffer, PagedPool);
if( result < 0 )
return result;
Driver = VfProbeAndCaptureUnicodeStringBuffer((_UNICODE_STRING *)&v118.Buffer, PagedPool);
if( Driver < 0 )
{
p_Buffer = (_UNICODE_STRING *)&v117.Buffer;
goto LABEL_101;
}
p_Destination = (unsigned __int64)&v117;
}
Driver = VfFaultsSetParameters(p_Destination);
if( !PreviousMode )
return Driver;
VfFreeCapturedUnicodeString((_UNICODE_STRING *)(p_Destination + 8));
p_Buffer = (_UNICODE_STRING *)(p_Destination + 24);
goto LABEL_101;
}
if( v5 > SystemPrefetcherInformation )
{
if( v5 <= SystemThreadPriorityClientIdInformation )
{
if( v5 != SystemThreadPriorityClientIdInformation )
{
if( v5 == SystemComPlusPackage )
{
if( (_DWORD)SystemInformationLength == 4 )
{
v39 = *(_DWORD *)SystemInformation;
Driver = ExpUpdateComPlusPackage(*(unsigned int *)SystemInformation);
if( Driver >= 0 )
KUSER_SHARED_DATA.ComPlusPackage = v39;
return Driver;
}
return -1073741820;
}
if( v5 != SystemHotpatchInformation )
{
if( v5 == SystemWatchdogTimerHandler )
return -1073741637;
if( v5 != SystemWatchdogTimerInformation )
{
if( v5 != SystemWow64SharedInformationObsolete )
{
switch( v5 )
{
case SystemRegisterFirmwareTableInformationHandler:
return ExpRegisterFirmwareTableInformationHandler(
SystemInformation,
(unsigned int)SystemInformationLength,
PreviousMode);
case SystemSuperfetchInformation:
LOBYTE(v8) = PreviousMode;
return PfSetSuperfetchInformation(0i64, SystemInformation, (unsigned int)SystemInformationLength, v8);
case SystemMemoryListInformation:
LOBYTE(SystemInformationLength) = PreviousMode;
return MmIssueMemoryListCommand(SystemInformation, v3, SystemInformationLength);
case SystemFileCacheInformationEx:
goto LABEL_154;
}
return -1073741821;
}
return -1073741822;
}
if( PreviousMode || !SystemInformation || (_DWORD)SystemInformationLength != 8 )
return -1073741811;
if( *(_DWORD *)SystemInformation )
{
switch( *(_DWORD *)SystemInformation )
{
case 1:
((void(__fastcall *)(_QWORD, VOID *, UINT64, __int64))off_140C008C0[0])(
(unsigned int)(*(_DWORD *)SystemInformation - 1),
SystemInformation,
SystemInformationLength,
1i64);
return 0;
case 2:
((void(__fastcall *)(_QWORD, VOID *, UINT64, __int64))off_140C008C8[0])(
(unsigned int)(*(_DWORD *)SystemInformation - 2),
SystemInformation,
SystemInformationLength,
1i64);
return 0;
case 3:
((void(__fastcall *)(_QWORD, VOID *, UINT64, __int64))off_140C008B8[0])(
(unsigned int)(*(_DWORD *)SystemInformation - 3),
SystemInformation,
SystemInformationLength,
1i64);
return 0;
}
if( *(_DWORD *)SystemInformation != 4 )
{
v38 = (unsigned int)(*(_DWORD *)SystemInformation - 6);
if( *(_DWORD *)SystemInformation == 6 )
{
LODWORD(v38) = 1;
return((__int64(__fastcall *)(__int64, VOID *, UINT64, __int64))off_140C008D8[0])(
v38,
SystemInformation,
SystemInformationLength,
1i64);
}
if( *(_DWORD *)SystemInformation == 7 )
{
Driver = 0;
if( (NTSTATUS(__stdcall *)(_EPROCESS *, PVOID, UINT64))off_140C008D8[0] == xKdEnumerateDebuggingDevices )
return -1073741822;
return Driver;
}
return -1073741811;
}
}
}
return -1073741637;
}
if( (unsigned int)SystemInformationLength < 0x18 )
return -1073741820;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseBasePriorityPrivilege, PreviousMode) )
return -1073741727;
if( PreviousMode )
{
v117 = *(_UNICODE_STRING *)p_Destination;
*(_QWORD *)&v118.Length = *(_QWORD *)(p_Destination + 16);
p_Destination = (unsigned __int64)&v117;
}
if( (unsigned int)(*(_DWORD *)(p_Destination + 16) - 1) > 0x1E )
return -1073741811;
v115 = *(_UNICODE_STRING *)p_Destination;
Driver = PsLookupProcessThreadByCid((__int64)&v115, 0i64, (PADAPTER_OBJECT *)&Thread);
if( Driver >= 0 )
{
v40 = Thread;
if( Thread->Tcb.gap0[4] )
{
Driver = -1073741749;
}
else
{
KeSetActualBasePriorityThread(&Thread->Tcb, *(unsigned int *)(p_Destination + 16));
Driver = 259;
}
v41 = (_ADAPTER_OBJECT *)v40;
LABEL_199:
HalPutDmaAdapter(v41);
return Driver;
}
return Driver;
}
v42 = v5 - 86;
if( !v42 )
return ObSetRefTraceInformation(SystemInformation, (unsigned int)SystemInformationLength);
v43 = v42 - 1;
if( !v43 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
{
if( v3 == 8 )
{
v54 = *(_QWORD *)p_Destination;
LODWORD(MmSpecialPoolTag) = *(_QWORD *)p_Destination;
MmSpecialPoolCatchOverruns = BYTE4(v54) & 1;
return Driver;
}
return -1073741820;
}
return -1073741790;
}
v44 = v43 - 2;
if( !v44 )
{
if( PreviousMode == 1 )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, 1) )
return -1073741727;
v52 = PsGetCurrentProcess()[1].AffinityPadding[10];
if( !v52 )
return DbgkRegisterErrorPort((WCHAR *)p_Destination, v3);
v53 = *(_WORD *)(v52 + 8);
if( v53 != 332 && v53 != 452 )
return DbgkRegisterErrorPort((WCHAR *)p_Destination, v3);
}
return -1073741637;
}
v45 = v44 - 2;
if( !v45 )
return HvlSetEnlightenmentInfo(*(UINT64 *)&SystemInformationClass, (INT8)SystemInformation);
v46 = v45 - 1;
if( !v46 )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
return -1073741790;
if( v3 == 40 )
return VfSetVerifierInformationEx(p_Destination);
return -1073741820;
}
v47 = v46 - 1;
if( v47 )
{
v48 = v47 - 1;
if( v48 )
{
if( v48 == 1 )
{
if( !PreviousMode || !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
return -1073741790;
if( v3 >= 0x18 )
{
LOBYTE(v13) = ExpCovResetInformation((_COVERAGE_MODULE_REQUEST *)p_Destination, v3, v49);
return v13;
}
return -1073741820;
}
return -1073741821;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
{
if( v3 == 8 )
{
*(_QWORD *)&v117.Length = *(_QWORD *)p_Destination;
_InterlockedOr(
(volatile signed __int32 *)&KUSER_SHARED_DATA.ImageFileExecutionOptions,
*(unsigned int *)&v117.Length);
_InterlockedAnd(
(volatile signed __int32 *)&KUSER_SHARED_DATA.ImageFileExecutionOptions,
~*(_DWORD *)(&v117.MaximumLength + 1));
return Driver;
}
return -1073741820;
}
return -1073741790;
}
v50 = 172;
if( (_DWORD)SystemInformationLength != 172 )
return -1073741820;
if( PreviousMode
&& !(unsigned __int8)ExpCapabilityCheck(&TimeZoneCapability)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeTimeZonePrivilege, PreviousMode) )
{
return -1073741727;
}
v51 = PsGetCurrentServerSiloGlobals(*(_KSPIN_LOCK **)&SystemInformationClass)->TzVirtualizationSupported == 0;
goto LABEL_220;
}
if( v5 == SystemPrefetcherInformation )
return PfSnSetPrefetcherInformation(
*(VOID **)&SystemInformationClass,
(UINT64)SystemInformation,
SystemInformationLength);
if( v5 <= SystemRegistryQuotaInformation )
{
if( v5 == SystemRegistryQuotaInformation )
{
if( (_DWORD)SystemInformationLength == 16 )
{
if( !PreviousMode || SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseQuotaPrivilege, PreviousMode) )
return CmSetRegistryQuotaInformation((unsigned int *)p_Destination);
return -1073741727;
}
return -1073741820;
}
if( v5 != SystemFlagsInformation )
{
if( v5 != SystemFileCacheInformation )
{
if( v5 == SystemDpcBehaviorInformation )
{
if( (_DWORD)SystemInformationLength == 20 )
{
if( !PreviousMode || SeSinglePrivilegeCheck(*(_QWORD *)&SeLoadDriverPrivilege, PreviousMode) )
{
v117 = *(_UNICODE_STRING *)p_Destination;
*(_DWORD *)&v118.Length = *(_DWORD *)(p_Destination + 16);
KiMaximumDpcQueueDepth = *(_DWORD *)(&v117.MaximumLength + 1);
KiAdjustDpcThreshold = HIDWORD(v117.Buffer);
KiMinimumDpcRate = (int)v117.Buffer;
KiIdealDpcRate = *(_DWORD *)&v118.Length;
KeSynchronizeWithDynamicProcessors();
ActiveProcessorCount = KeQueryActiveProcessorCountEx(0xFFFFu);
if( ActiveProcessorCount )
{
v19 = &KiProcessorBlock;
v20 = ActiveProcessorCount;
do
{
v21 = *v19;
v21->MaximumDpcQueueDepth = KiMaximumDpcQueueDepth;
v21->MinimumDpcRate = KiMinimumDpcRate;
++v19;
--v20;
}
while( v20 );
}
return Driver;
}
return -1073741727;
}
return -1073741820;
}
if( v5 != SystemLoadGdiDriverInformation )
{
if( v5 != SystemUnloadGdiDriverInformation )
{
if( v5 != SystemTimeAdjustmentInformation )
{
switch( v5 )
{
case SystemMirrorMemoryInformation:
return MmCreateMirror();
case SystemPerformanceTraceInformation:
LOBYTE(SystemInformationLength) = PreviousMode;
return EtwSetPerformanceTraceInformation(SystemInformation, v3, (VOID *)SystemInformationLength);
case SystemCrashDumpStateInformation:
if( (!PreviousMode || SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode))
&& !PsIsCurrentThreadInServerSilo() )
{
if( v3 != 4 )
goto LABEL_28;
if( PreviousMode )
{
if( (p_Destination & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( p_Destination + 4 > 0x7FFFFFFF0000i64 || p_Destination + 4 < p_Destination )
MEMORY[0x7FFFFFFF0000] = 0;
v14 = *(_DWORD *)p_Destination;
v109 = *(_DWORD *)p_Destination;
}
else
{
v14 = *(_DWORD *)p_Destination;
}
if( !v14 )
{
v12 = CrashDumpDisable;
return IoConfigureCrashDump(v12, 0);
}
v15 = v14 - 1;
if( !v15 )
{
LABEL_28:
v12 = CrashDumpReconfigure;
return IoConfigureCrashDump(v12, 0);
}
if( v15 == 1 )
return WheaCrashDumpInitializationComplete();
return -1073741811;
}
return -1073741727;
}
return -1073741821;
}
if( (((_DWORD)SystemInformationLength - 8) & 0xFFFFFFF7) == 0 )
{
if( PreviousMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemtimePrivilege, PreviousMode) )
return -1073741727;
if( !PsIsCurrentThreadInServerSilo() )
{
if( v3 == 16 )
{
v16 = *(_BYTE *)(p_Destination + 8);
LOBYTE(NewTimeSynchronization) = v16;
NewTimeAdjustment = *(_QWORD *)p_Destination;
}
else
{
v16 = *(_BYTE *)(p_Destination + 4);
LOBYTE(NewTimeSynchronization) = v16;
v17 = *(unsigned int *)p_Destination;
NewTimeAdjustment = v17;
if( v17 )
NewTimeAdjustment = KUSER_SHARED_DATA.QpcFrequency
* (unsigned __int64)(unsigned int)KeMaximumIncrement
/ v17;
}
if( v16 )
NewTimeAdjustment = KUSER_SHARED_DATA.QpcFrequency;
ExAcquireTimeRefreshLock(1u);
Driver = ExpUpdateTimerConfiguration(0i64, &NewTimeAdjustment, (UINT8 *)&NewTimeSynchronization);
ExReleaseTimeRefreshLock();
return Driver;
}
return -1073741790;
}
return -1073741820;
}
if( (_DWORD)SystemInformationLength != 8 )
return -1073741820;
if( PreviousMode )
return -1073741727;
MmUnloadSystemImage(*(VOID **)SystemInformation);
return 0;
}
LABEL_132:
if( (_DWORD)SystemInformationLength == 56 )
{
if( !PreviousMode )
{
Destination = *(_UNICODE_STRING *)SystemInformation;
v33 = MmLoadSystemImage(&Destination, 0i64, 0i64, v8, (VOID **)&ImageBaseAddress, (VOID **)&v98);
Driver = v33;
if( v33 < 0 )
{
if( v33 == -1073741411 )
return -1073741554;
}
else
{
v34 = RtlImageDirectoryEntryToData((VOID *)v98, 1u, 0, &Size);
LODWORD(v35) = RtlImageNtHeader(v98);
*(_QWORD *)(p_Destination + 40) = v34;
v36 = v98 + *(unsigned int *)(v35 + 40);
*(_QWORD *)(p_Destination + 16) = v98;
*(_QWORD *)(p_Destination + 24) = ImageBaseAddress;
*(_QWORD *)(p_Destination + 32) = v36;
*(_DWORD *)(p_Destination + 48) = *(_DWORD *)(v35 + 80);
}
return Driver;
}
return -1073741727;
}
return -1073741820;
}
LABEL_154:
BYTE1(NewTimeSynchronization) = 0;
if( (unsigned int)SystemInformationLength >= 0x40 )
{
if( v5 == SystemFileCacheInformation )
{
v37 = 0;
}
else
{
HIDWORD(Size) = *((_DWORD *)SystemInformation + 15);
v37 = HIDWORD(Size);
if( (Size & 0xFFFFFFF000000000ui64) != 0 || (BYTE4(Size) & 0xC) == 12 || (BYTE4(Size) & 3) == 3 )
return -1073741584;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseQuotaPrivilege, PreviousMode) )
{
LODWORD(Object) = v37;
MmAdjustWorkingSetSizeEx(
*(_QWORD *)(p_Destination + 24),
*(_QWORD *)(p_Destination + 32),
WorkingSetTypeSystemTypes,
1u,
(UINT64)Object,
(UINT8 *)&NewTimeSynchronization + 1);
return result;
}
return -1073741790;
}
return -1073741820;
}
if( (_DWORD)SystemInformationLength == 4 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
{
NtGlobalFlag = *(_DWORD *)p_Destination ^ (NtGlobalFlag ^ *(_DWORD *)p_Destination) & 0x6DCE640F;
*(_DWORD *)p_Destination = NtGlobalFlag;
return Driver;
}
return -1073741790;
}
return -1073741820;
}
if( v5 > SystemSessionCreate )
{
v30 = v5 - 48;
if( v30 )
{
v31 = v30 - 3;
if( !v31 )
{
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
return VfSetVerifierInformation((VOID *)p_Destination, v3, 0);
return -1073741790;
}
v32 = v31 - 1;
if( !v32 )
{
if( !PreviousMode )
return MmAddVerifierThunks(SystemInformation, (unsigned int)SystemInformationLength);
return -1073741727;
}
if( v32 == 2 )
{
v8 = 0i64;
goto LABEL_132;
}
return -1073741821;
}
return -1073741822;
}
if( v5 == SystemSessionCreate )
return -1073741822;
if( v5 != SystemExtendServiceTableInformation )
{
if( v5 != SystemPrioritySeperation )
{
if( v5 > SystemVerifierRemoveDriverInformation )
{
if( v5 == SystemTimeSlipNotification )
{
if( (_DWORD)SystemInformationLength != 8 )
return -1073741820;
if( PreviousMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemtimePrivilege, PreviousMode) )
return -1073741727;
if( PsIsCurrentThreadInServerSilo() )
return -1073741790;
v112 = *(VOID **)p_Destination;
if( v112 )
{
Event = 0i64;
Driver = ObReferenceObjectByHandle(
v112,
2ui64,
(_OBJECT_TYPE *)ExEventObjectType,
PreviousMode,
&Event,
0i64);
v22 = Event;
if( Driver < 0 )
return Driver;
}
else
{
v22 = 0i64;
Driver = 0;
}
KdUpdateTimeSlipEvent(v22);
return Driver;
}
return -1073741821;
}
if( (_DWORD)SystemInformationLength != 16 )
return -1073741820;
if( PreviousMode )
{
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, PreviousMode) )
return -1073741727;
result = VfProbeAndCaptureUnicodeString(&Destination, (_UNICODE_STRING *)p_Destination, PagedPool);
if( result < 0 )
return result;
p_Destination = (unsigned __int64)&Destination;
if( !Destination.Length )
return -1073741585;
}
v24 = v5 - 40;
if( v24 )
{
if( v24 != 1 )
{
Driver = -1073741821;
LABEL_99:
if( !PreviousMode )
return Driver;
p_Buffer = (_UNICODE_STRING *)p_Destination;
LABEL_101:
VfFreeCapturedUnicodeString(p_Buffer);
return Driver;
}
v25 = VfRemoveVerifierEntry((_UNICODE_STRING *)p_Destination);
}
else
{
v25 = VfAddVerifierEntry((_UNICODE_STRING *)p_Destination);
}
Driver = v25;
goto LABEL_99;
}
if( (_DWORD)SystemInformationLength != 4 )
return -1073741820;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
return -1073741727;
PsChangeQuantumTable(1u, *(unsigned int *)p_Destination);
return 0;
}
if( (_DWORD)SystemInformationLength != 16 )
return -1073741820;
if( PreviousMode )
{
if( (PsGetCurrentProcess()[1].IdealProcessorPadding[10] & 0x100) == 0
|| !SeSinglePrivilegeCheck(*(_QWORD *)&SeLoadDriverPrivilege, 1) )
{
return -1073741727;
}
if( p_Destination >= 0x7FFFFFFF0000i64 )
p_Destination = 0x7FFFFFFF0000i64;
*(_DWORD *)&Destination.Length = *(_DWORD *)p_Destination;
Destination.Buffer = *(wchar_t **)(p_Destination + 8);
if( Destination.Length == 62 )
{
if( !memcmp(Destination.Buffer, L"\\SystemRoot\\System32\\win32k.sys", 0x3Eui64) )
{
Destination.Buffer = L"\\SystemRoot\\System32\\win32k.sys";
Destination.MaximumLength = 62;
return ZwSetSystemInformation(SystemExtendServiceTableInformation, &Destination, 0x10ui64);
}
else
{
return -1073741727;
}
}
else
{
return -1073741727;
}
}
else
{
Destination = *(_UNICODE_STRING *)SystemInformation;
if( !memcmp(
(const VOID *)_mm_srli_si128((__m128i)Destination, 8).m128i_i64[0],
L"\\SystemRoot\\System32\\win32k.sys",
0x3Eui64) )
v7 = -2147483643;
result = MmLoadSystemImageEx(&Destination, 0i64, 0i64, v7, (INT64)&ImageBaseAddress, (INT64)&v98);
if( result >= 0 )
{
LODWORD(v27) = RtlImageNtHeader(v98);
if( !v27 )
{
MmUnloadSystemImage((VOID *)ImageBaseAddress);
return -1073741701;
}
Driver = ExpInitializeSessionDriver(v98 + *(unsigned int *)(v27 + 40), (INT64 *)v98, v28, v29, Objecta);
if( Driver < 0 )
MmUnloadSystemImage((VOID *)ImageBaseAddress);
return Driver;
}
if( result == -1073741411 )
return -1073741554;
}
return result;
}Referenced by:
WmipRegisterFirmwareProviders