NtCreateUserProcess
NTSTATUS __stdcall NtCreateUserProcess(
PVOID *ProcessHandle,
PVOID *ThreadHandle,
UINT64 ProcessDesiredAccess,
UINT64 ThreadDesiredAccess,
_OBJECT_ATTRIBUTES *ProcessObjectAttributes,
_OBJECT_ATTRIBUTES *ThreadObjectAttributes,
UINT64 ProcessFlags,
UINT64 ThreadFlags,
_RTL_USER_PROCESS_PARAMETERS *ProcessParameters,
_PS_CREATE_INFO *CreateInfo,
_PS_ATTRIBUTE_LIST *AttributeList){
_ETHREAD *CurrentThread;
_EPROCESS *v12;
INT8 PreviousMode;
unsigned int v14;
NTSTATUS result;
__int64 v16;
__int64 v17;
unsigned int v18;
NTSTATUS Info;
INT8 v20;
__int64 v21;
_KPROCESSOR_MODE v22;
unsigned __int8 v23;
unsigned int v24;
PS_CREATE_STATE v25;
char v26;
int v27;
NTSTATUS v28;
int v29;
_ADAPTER_OBJECT *v30;
UINT8 SignatureLevel;
UINT8 v32;
_PS_PROTECTION v33;
__int64 v34;
__int64 v35;
UINT8 v36;
_PS_PROTECTION *v37;
_ETHREAD **v38;
UINT8 v39;
unsigned int v40;
unsigned int v41;
unsigned __int64 v42;
void *v43;
INT64 Peb;
_EPROCESS *v45;
__int64 v46;
INT64 v47;
_EPROCESS *v48;
INT64 v49;
UINT8 v50;
UINT64 v51;
unsigned int v52;
_UNICODE_STRING *v53;
NTSTATUS inserted;
__int64 v55;
_OWORD *v56;
INT8 v57;
UINT64 Tag;
UINT64 Taga;
UINT64 Tagb;
VOID **Object;
VOID **Objecta;
VOID **Objectb;
VOID **Objectc;
_OBJECT_HANDLE_INFORMATION *HandleInformation;
_OBJECT_HANDLE_INFORMATION *HandleInformationa;
_HANDLE_TABLE_ENTRY_INFO *ObjectInfo;
_HANDLE_TABLE_ENTRY_INFO *ObjectInfoa;
UINT64 CreateOptions;
PSP_CREATE_PROCESS_CONTEXT *EaBuffer;
UINT64 EaLength;
UINT64 EaLengtha;
PSP_ALLOCATE_PROCESS_STATE *CreateFileType;
PSP_OBJECT_CREATION_STATE *InternalParameters;
UINT64 Options;
UINT64 Optionsa;
int v77;
PS_PROTECTION v78;
UINT8 SectionSignatureLevel;
__int16 v80;
UINT8 ExeSigningLevel;
char v82;
_EPROCESS *Process;
INT8 v84;
int StartContext;
int InsertFlags;
size_t InsertFlags_4;
unsigned int DesiredAccess;
unsigned int DesiredAccess_4;
INT64 v90;
PADAPTER_OBJECT v91;
INT64 v92;
_ETHREAD *Thread;
PSP_OBJECT_CREATION_STATE *ThreadAccessState;
__int64 v95;
PSP_CREATE_THREAD_FLAGS CreateFlags[2];
_OBJECT_ATTRIBUTES *v97;
PVOID v98;
PVOID v99;
_RTL_USER_PROCESS_PARAMETERS *UserProcessParameters;
__int64 v101;
PVOID *v102;
_EJOB *ServerSilo;
_OBJECT_ATTRIBUTES ObjectAttributes;
__int64 v105;
_OBJECT_ATTRIBUTES *v106;
_EPROCESS *v107;
__int128 InputBuffer;
_IO_STATUS_BLOCK IoStatusBlock;
_IO_DRIVER_CREATE_CONTEXT DriverCreateContext;
_PSP_USER_BASES UserBases[4];
__int64 v112;
_PSP_STACK_ALLOCATION_STATE v113[5];
_QWORD CreateContext[66];
_BYTE ObjectAccessState[400];
PSP_STACK_ALLOCATION_STATE StackAllocationState[100];
_ETHREAD *NewThread[2];
__int128 v118;
DesiredAccess = ThreadDesiredAccess;
DesiredAccess_4 = ProcessDesiredAccess;
v101 = (__int64)ThreadHandle;
v102 = ProcessHandle;
v97 = ProcessObjectAttributes;
v106 = ThreadObjectAttributes;
UserProcessParameters = ProcessParameters;
v95 = 0i64;
StartContext = 0;
IoStatusBlock = 0i64;
Process = 0i64;
*(_QWORD *)CreateFlags = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
v90 = 0i64;
memset(ObjectAccessState, 0i64, sizeof(ObjectAccessState));
InputBuffer = 0i64;
v80 = 0;
SectionSignatureLevel = 0;
ExeSigningLevel = 0;
*(_OWORD *)NewThread = 0i64;
v118 = 0i64;
memset(StackAllocationState, 0i64, sizeof(StackAllocationState));
v105 = 0i64;
InsertFlags_4 = 0;
ServerSilo = 0i64;
*(_OWORD *)UserBases = 0i64;
v112 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Thread = CurrentThread;
v12 = CurrentThread->Tcb.ApcState.Process;
v92 = (INT64)v12;
v107 = v12;
PreviousMode = CurrentThread->Tcb.PreviousMode;
v84 = PreviousMode;
ThreadAccessState = 0i64;
v91 = 0i64;
LOBYTE(CurrentThread) = 0;
v77 = (int)CurrentThread;
v82 = 0;
memset(&DriverCreateContext, 0, sizeof(DriverCreateContext));
memset(v113, 0i64, 0x48u);
v14 = ProcessFlags;
if( (ProcessFlags & 0xFFFB6838) != 0 || (ThreadFlags & 0xFFFFFFFE) != 0 )
return -1073741811;
if( (ProcessFlags & 0x8400) == 33792 )
return -1073741776;
ObjectAccessState[388] = PreviousMode;
if( PreviousMode )
{
v16 = (__int64)v102;
if( (unsigned __int64)v102 >= 0x7FFFFFFF0000i64 )
v16 = 0x7FFFFFFF0000i64;
*(_QWORD *)v16 = *(_QWORD *)v16;
v17 = v101;
if( (unsigned __int64)v101 >= 0x7FFFFFFF0000i64 )
v17 = 0x7FFFFFFF0000i64;
*(_QWORD *)v17 = *(_QWORD *)v17;
}
if( ProcessObjectAttributes )
{
if( PreviousMode && ((unsigned __int8)ProcessObjectAttributes & 3) != 0 )
ExRaiseDatatypeMisalignment();
if( PreviousMode )
v18 = ProcessObjectAttributes->Attributes & 0x1DF2;
else
v18 = ProcessObjectAttributes->Attributes & 0x11FF2;
*(_DWORD *)&ObjectAccessState[384] = v18;
}
memset(CreateContext, 0i64, 0x208u);
if( !AttributeList
|| (result = PspBuildCreateProcessContext(
AttributeList,
PreviousMode,
0i64,
(PSP_CREATE_PROCESS_CONTEXT *)CreateContext),
result >= 0) )
{
if( (ProcessFlags & 0x40) != 0 && (CreateContext[0] & 0x2000000000000i64) != 0 && !LOBYTE(CreateContext[48]) )
{
v14 = ProcessFlags & 0xFFFFFFBF;
LODWORD(ProcessFlags) = ProcessFlags & 0xFFFFFFBF;
HIDWORD(CreateContext[0]) &= ~0x20000u;
}
if( (v14 & 4) == 0 && (CreateContext[0] & 0x80000000000i64) != 0
|| (CreateContext[0] & 0x2000000000000i64) != 0 && (v14 & 0x40) == 0 )
{
goto LABEL_167;
}
Info = PspCaptureCreateInfo(PreviousMode, CreateInfo, (PSP_CREATE_PROCESS_CONTEXT *)CreateContext);
if( Info >= 0 )
{
v20 = 1;
if( (CreateContext[0] & 0x100000000i64) == 0 )
{
v90 = (INT64)v12;
LABEL_33:
LODWORD(v21) = PspEstimateNewProcessServerSilo((INT64)v12, CreateContext[50], HIDWORD(CreateContext[51]));
CreateContext[58] = v21;
if( (BYTE1(CreateContext[1]) & 0xC) != 4 || v12 == (_EPROCESS *)v92 && (*(_DWORD *)(v92 + 2172) & 0x1000) == 0 )
{
LOBYTE(v22) = PreviousMode;
Info = PspReferenceTokenForNewProcess(&v12->Pcb, (VOID *)CreateContext[18], v22, (VOID **)&CreateContext[19]);
if( Info < 0 )
{
CreateContext[19] = 0i64;
goto LABEL_168;
}
if( !CreateContext[18]
|| SeQueryServerSiloToken((VOID *)CreateContext[19], (PFLUSH_ADAPTER_BUFFERS_EX *)&ServerSilo) < 0
|| PspIsSiloInSilo(ServerSilo, (_EJOB *)CreateContext[58]) )
{
if( (CreateContext[0] & 0x2000000000i64) != 0 )
{
v23 = (CreateContext[0] & 0x2000000000000i64) != 0 ? LOBYTE(CreateContext[48]) : 0;
v78.Level = v23;
if( (NtGlobalFlag & 0x40000) != 0 )
{
InputBuffer = *(_OWORD *)&CreateContext[29];
LODWORD(Tag) = 0;
ZwSystemDebugControl(
SysDbgClearUmAttachPid|SysDbgSetTracepoint,
&InputBuffer,
0x10ui64,
0i64,
Tag,
0i64);
}
Info = SeQuerySigningPolicy(
(VOID *)CreateContext[19],
(_UNICODE_STRING *)&CreateContext[29],
(v14 >> 6) & 1,
(PS_PROTECTION)v23,
(UINT8 *)&v80,
&SectionSignatureLevel,
&v78);
if( Info < 0 )
goto LABEL_168;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
v24 = 1600;
if( PreviousMode != 1 )
v24 = 576;
ObjectAttributes.Attributes = v24;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)&CreateContext[29];
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
Info = 0;
if( qword_140D2C440 )
Info = qword_140D2C440(CreateContext[19]);
if( Info < 0 )
goto LABEL_168;
Info = PspGetMemoryPartitionContext(
(__int64)v12,
v14,
CreateContext[50],
HIDWORD(CreateContext[51]),
(_XSTATE_FEATURE *)&ThreadAccessState);
if( Info < 0 )
goto LABEL_168;
Info = PspCreateUserProcessEcp(&DriverCreateContext, (VOID *)CreateContext[19]);
if( Info < 0 )
goto LABEL_168;
LODWORD(Options) = 0;
LODWORD(EaLength) = 0;
LODWORD(CreateOptions) = 96;
LODWORD(ObjectInfo) = 1;
LODWORD(HandleInformation) = 5;
LODWORD(Object) = 128;
Info = IoCreateFileEx(
(VOID **)&CreateContext[21],
LODWORD(CreateContext[20]) | 0x100020u,
&ObjectAttributes,
&IoStatusBlock,
0i64,
(UINT64)Object,
(UINT64)HandleInformation,
(UINT64)ObjectInfo,
CreateOptions,
0i64,
EaLength,
CreateFileTypeNone,
0i64,
Options,
&DriverCreateContext);
if( Info < 0 && LODWORD(CreateContext[20]) )
{
LODWORD(Optionsa) = 0;
LODWORD(EaLengtha) = 0;
LODWORD(CreateOptions) = 96;
LODWORD(ObjectInfoa) = 1;
LODWORD(HandleInformationa) = 5;
LODWORD(Objecta) = 128;
Info = IoCreateFileEx(
(VOID **)&CreateContext[21],
0x100020ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
(UINT64)Objecta,
(UINT64)HandleInformationa,
(UINT64)ObjectInfoa,
CreateOptions,
0i64,
EaLengtha,
CreateFileTypeNone,
0i64,
Optionsa,
&DriverCreateContext);
}
if( Info < 0 )
{
CreateContext[21] = 0i64;
v25 = PsCreateFailOnFileOpen;
LABEL_57:
PspUpdateCreateInfo(v25, (PSP_CREATE_PROCESS_CONTEXT *)CreateContext, 0i64);
goto LABEL_168;
}
v98 = 0i64;
Info = ObReferenceObjectByHandle(
(VOID *)CreateContext[21],
0x100020ui64,
(_OBJECT_TYPE *)IoFileObjectType,
0,
&v98,
0i64);
CreateContext[22] = v98;
if( Info < 0 )
{
CreateContext[22] = 0i64;
v26 = v77;
LABEL_171:
if( ThreadAccessState )
ObfDereferenceObjectWithTag(ThreadAccessState, 0x624A7350ui64);
PspDeleteCreateProcessContext((_PSP_CREATE_PROCESS_CONTEXT *)CreateContext);
if( DriverCreateContext.ExtraCreateParameter )
FsRtlFreeExtraCreateParameterList(DriverCreateContext.ExtraCreateParameter);
if( v26 )
HalPutDmaAdapter(v91);
return Info;
}
ObjectAttributes.ObjectName = 0i64;
v27 = 1;
if( CreateContext[49] )
v27 = 5;
InsertFlags = v27;
if( CreateContext[53] )
{
v28 = SeDuplicateTokenAndAddOriginClaim(
(EVT_WDF_IO_TARGET_QUERY_REMOVE *)CreateContext[19],
(_XSTATE_FEATURE *)CreateContext[53],
LODWORD(CreateContext[54]),
(_XSTATE_FEATURE **)&v91);
v29 = (unsigned __int8)v77;
if( v28 >= 0 )
v29 = 1;
v77 = v29;
v82 = v29;
}
else
{
LOBYTE(v29) = v77;
}
v30 = v91;
if( !(_BYTE)v29 )
v30 = (_ADAPTER_OBJECT *)CreateContext[19];
v91 = v30;
LODWORD(Objectb) = v27;
SignatureLevel = v80;
v32 = v80;
while( 1 )
{
Info = MmCreateSpecialImageSection(
(PVOID *)&CreateContext[23],
&ObjectAttributes,
v30,
v32,
(PVOID)CreateContext[21],
(UINT64)Objectb);
if( Info < 0 )
{
CreateContext[23] = 0i64;
v25 = PsCreateFailOnSectionCreate;
goto LABEL_57;
}
v99 = 0i64;
Info = ObReferenceObjectByHandle((VOID *)CreateContext[23], 8ui64, MmSectionObjectType, 0, &v99, 0i64);
CreateContext[25] = v99;
if( Info < 0 )
{
CreateContext[25] = 0i64;
goto LABEL_168;
}
v33.Level = v78.Level;
Info = PspGetProcessProtectionRequirementsFromImage((INT64)v99);
if( Info < 0 )
goto LABEL_168;
if( HIBYTE(v80) == v33.Level )
break;
Info = SeQuerySigningPolicy(
(VOID *)CreateContext[19],
(_UNICODE_STRING *)&CreateContext[29],
1ui64,
(PS_PROTECTION)SHIBYTE(v80),
&ExeSigningLevel,
&SectionSignatureLevel,
&v78);
if( Info < 0 )
goto LABEL_168;
v36 = ExeSigningLevel;
if( ExeSigningLevel == SignatureLevel )
{
v33.Level = v78.Level;
break;
}
if( (SignatureLevel & 0x30) != 0 && (ExeSigningLevel & 0x30) != (SignatureLevel & 0x30) )
goto LABEL_167;
if( !qword_140C1D900 )
goto LABEL_167;
LOBYTE(v34) = SignatureLevel;
LOBYTE(v35) = ExeSigningLevel;
if( !(unsigned int)qword_140C1D900(v35, v34) )
goto LABEL_167;
ObCloseHandle((VOID *)CreateContext[23], 0);
HalPutDmaAdapter((PADAPTER_OBJECT)CreateContext[25]);
CreateContext[23] = 0i64;
CreateContext[25] = 0i64;
SignatureLevel = v36;
LOBYTE(v80) = v36;
LODWORD(Objectb) = InsertFlags;
v32 = v36;
v30 = v91;
}
LOBYTE(Taga) = v33;
Info = PspValidateCreateProcessProtection(v92, (INT64)CreateContext, PreviousMode, v14, Taga);
if( Info < 0 )
goto LABEL_168;
if( (v14 & 0x40000) != 0
|| (v33.Level & 7) != 1 && PspCheckForInvalidAccessByProtection(PreviousMode, v37[2170], v33) )
{
LOBYTE(CreateContext[1]) |= 8u;
}
PspGetProcessParameterOverrides((__int64)CreateContext, (__int64)ThreadAccessState);
Info = PspCaptureProcessParameters(
PreviousMode,
UserProcessParameters,
(PSP_CREATE_PROCESS_CONTEXT *)CreateContext);
if( Info < 0 )
{
LOBYTE(CreateContext[1]) &= ~4u;
goto LABEL_168;
}
v38 = NewThread;
v39 = SectionSignatureLevel;
goto LABEL_104;
}
if( v12 == (_EPROCESS *)v92
&& PreviousMode
&& !UserProcessParameters
&& (CreateContext[1] & 0xC00i64) == 0
&& (CreateContext[0] & 0x8000000000i64) == 0
&& (CreateContext[0] & 0x2000000000000i64) == 0
&& (CreateContext[1] & 0x10) == 0 )
{
LOBYTE(CreateContext[1]) &= ~4u;
v33.Level = v12->Protection.Level;
v78.Level = v33.Level;
SectionSignatureLevel = v12->SectionSignatureLevel;
SignatureLevel = v12->SignatureLevel;
LOBYTE(v80) = SignatureLevel;
if( (v14 & 0x40) != 0 && (v33.Level & 7) == 0 )
{
Info = -1073741790;
goto LABEL_168;
}
LOBYTE(Tag) = v33;
Info = PspValidateCreateProcessProtection(v92, (INT64)CreateContext, PreviousMode, v14, Tag);
if( Info < 0 )
goto LABEL_168;
v38 = 0i64;
LABEL_104:
LODWORD(CreateFileType) = CreateContext[18] != 0i64;
LODWORD(EaBuffer) = 0;
LODWORD(CreateOptions) = ProcessFlags;
Info = PspAllocateProcess(
(_EPROCESS *)v90,
PreviousMode,
v97,
v33,
SignatureLevel,
v39,
(VOID *)CreateContext[25],
(VOID *)CreateContext[19],
CreateOptions,
EaBuffer,
(UINT64)CreateContext,
CreateFileType,
(_EPROCESS **)ThreadAccessState);
if( Info < 0 )
goto LABEL_168;
v40 = Process->MitigationFlags2 & 0x4000;
v97 = v40 != 0 ? (_OBJECT_ATTRIBUTES *)0x800 : 0i64;
v41 = (CreateContext[25] != 0i64 ? 1048587 : 1048603) | 0x100040;
if( !v40 )
v41 = CreateContext[25] != 0i64 ? 1048587 : 1048603;
RtlGetExtendedContextLength2(v41, &InsertFlags_4, v40 != 0 ? 0x800 : 0);
v42 = InsertFlags_4 + 15i64;
if( v42 <= InsertFlags_4 )
v42 = 0xFFFFFFFFFFFFFF0i64;
v43 = alloca(v42 & 0xFFFFFFFFFFFFFFF0ui64);
memset(&v77, 0i64, InsertFlags_4);
RtlInitializeExtendedContext2((__int64)&v77, v41, &v105, (unsigned __int64)v97);
if( CreateContext[25] )
{
Peb = HIDWORD(CreateContext[28]);
if( !Process->WoW64Process )
Peb = (INT64)Process->Peb;
PspCreateUserContext((INT64)&v77, 1, PspUserThreadStart, CreateContext[6], Peb);
}
else
{
Info = PspGetContextThreadInternal(Thread, (_CONTEXT *)&v77, 0, 1, 1u);
if( Info < 0 )
{
v45 = Process;
if( (_InterlockedExchangeAdd64(&Process->ProcessLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&v45->ProcessLock);
KeAbPostRelease(&v45->ProcessLock);
KeLeaveCriticalRegionThread(&Thread->Tcb);
PspRundownSingleProcess(Process, 0);
goto LABEL_168;
}
v99 = (PVOID)297;
}
ObfReferenceObjectWithTag(Process, 0x72437350ui64);
if( v38 )
{
*(_BYTE *)v38 = 0;
v46 = CreateContext[8];
if( CreateContext[8] < 0x40000ui64 )
v46 = 0x40000i64;
v38[3] = (_ETHREAD *)v46;
v38[2] = (_ETHREAD *)CreateContext[9];
v38[1] = (_ETHREAD *)LODWORD(CreateContext[7]);
}
InsertFlags = 0;
PspMapThreadCreationFlags(ThreadFlags, &StartContext);
if( (_DWORD)v95 )
{
InsertFlags = 2;
StartContext |= 0x10u;
}
if( HIDWORD(v95) )
LODWORD(ProcessFlags) = ProcessFlags | 0x400;
*(_QWORD *)UserBases = v113;
StartContext |= 0x60u;
LOBYTE(v47) = PreviousMode;
Info = PspAllocateThread(
Process,
v106,
v47,
(PSP_CREATE_PROCESS_CONTEXT *)CreateContext,
(_CONTEXT *)&v77,
UserBases,
0i64,
0i64,
&StartContext,
CreateFlags,
v38,
StackAllocationState,
InternalParameters);
if( Info < 0 )
{
v48 = Process;
if( (_InterlockedExchangeAdd64(&Process->ProcessLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&v48->ProcessLock);
KeAbPostRelease(&v48->ProcessLock);
KeLeaveCriticalRegionThread(&Thread->Tcb);
PspRundownSingleProcess(Process, 0);
v26 = v77;
goto LABEL_166;
}
v49 = v92;
v50 = PsTestProtectedProcessIncompatibility(PreviousMode, (_EPROCESS *)v92, Process);
v51 = DesiredAccess_4;
if( v50 )
{
if( (DesiredAccess_4 & 0x2000000) != 0 )
{
v51 = ~*(_DWORD *)&RtlProtectedAccess[12 * ((unsigned __int64)v33.Level >> 4) + 4] & 0x1FFFFF | DesiredAccess_4;
LODWORD(v51) = ~*(_DWORD *)&RtlProtectedAccess[12 * ((unsigned __int64)v33.Level >> 4) + 4] & 0x1FFFFF | DesiredAccess_4 & 0xFDFFFFFF;
if( !CreateContext[16] || v49 == CreateContext[16] )
v51 = (unsigned int)v51 | 1;
}
v52 = DesiredAccess;
if( (DesiredAccess & 0x2000000) != 0 )
{
v52 = ~*(_DWORD *)&RtlProtectedAccess[12 * ((unsigned __int64)v33.Level >> 4) + 8] & 0x1FFFFF | DesiredAccess & 0xFDFFFFFF;
if( !CreateContext[16] || v49 == CreateContext[16] )
v52 |= 1u;
}
}
else
{
v52 = DesiredAccess;
}
if( CreateContext[26] )
v53 = (_UNICODE_STRING *)(CreateContext[26] + 112i64);
else
v53 = 0i64;
LODWORD(Objectc) = InsertFlags;
inserted = PspInsertProcess(
Process,
(_EPROCESS *)v90,
v51,
(unsigned int)ProcessFlags,
(VOID *)CreateContext[17],
(UINT64)Objectc,
v53,
(PSP_OBJECT_CREATION_STATE *)ObjectAccessState);
LODWORD(Tagb) = v52;
Info = PspInsertThread(
*(_ETHREAD **)CreateFlags,
Process,
v113,
&StartContext,
Tagb,
(__int64)v38,
(PSP_CREATE_PROCESS_CONTEXT *)CreateContext,
0i64,
(_ACCESS_STATE *)StackAllocationState,
v101,
CreateContext[2]);
KeLeaveCriticalRegionThread(&Thread->Tcb);
if( inserted < 0 )
{
PspRundownSingleProcess(Process, 0);
Info = inserted;
v26 = v77;
LABEL_165:
HalPutDmaAdapter(*(PADAPTER_OBJECT *)CreateFlags);
LABEL_166:
ObfDereferenceObjectWithTag(Process, 0x72437350ui64);
goto LABEL_169;
}
if( Info < 0 )
{
v26 = v77;
LABEL_163:
if( Info >= 0 )
goto LABEL_165;
LABEL_164:
PsTerminateProcess((ULONG_PTR)Process, (unsigned int)Info);
goto LABEL_165;
}
LODWORD(v55) = PsGetProcessServerSilo((INT64)Process);
if( v55 != CreateContext[58] )
{
Info = -1073741267;
v26 = v77;
goto LABEL_164;
}
Info = PspCreateObjectHandle(
Process,
(PSP_OBJECT_CREATION_STATE *)ObjectAccessState,
(_OBJECT_TYPE *)PsProcessType);
if( Info < 0 )
{
v26 = v77;
}
else
{
v56 = (_OWORD *)CreateContext[4];
if( CreateContext[4] )
{
*(_OWORD *)CreateContext[4] = *(_OWORD *)&CreateContext[6];
v56[1] = *(_OWORD *)&CreateContext[8];
v56[2] = *(_OWORD *)&CreateContext[10];
v56[3] = *(_OWORD *)&CreateContext[12];
}
*v102 = *(PVOID *)&ObjectAccessState[392];
v26 = v77;
Info = PspUpdateCreateInfo(PsCreateSuccess, (PSP_CREATE_PROCESS_CONTEXT *)CreateContext, Process);
if( Info >= 0 )
goto LABEL_161;
if( (*(_WORD *)&ObjectAccessState[384] & 0x200) != 0
|| (v57 = 1, (*(_DWORD *)(v49 + 2172) & 0x1000) != 0) )
{
v57 = 0;
}
ObCloseHandle(*(VOID **)&ObjectAccessState[392], v57);
}
if( (StackAllocationState[96] & 0x200) != 0 || (*(_DWORD *)(v49 + 2172) & 0x1000) != 0 )
v20 = 0;
ObCloseHandle(*(VOID **)&StackAllocationState[98], v20);
LABEL_161:
SepDeleteAccessState((_ACCESS_STATE *)ObjectAccessState);
SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)&ObjectAccessState[32]);
goto LABEL_163;
}
}
}
LABEL_167:
Info = -1073741811;
goto LABEL_168;
}
LODWORD(Tag) = 1917023056;
Info = ObpReferenceObjectByHandleWithTag(
(VOID *)CreateContext[15],
0x80ui64,
(_OBJECT_TYPE *)PsProcessType,
PreviousMode,
Tag,
(VOID **)&v90,
0i64,
0i64);
if( Info >= 0 )
{
v12 = (_EPROCESS *)v90;
CreateContext[16] = v90;
goto LABEL_33;
}
}
LABEL_168:
v26 = v77;
LABEL_169:
if( CreateContext[22] )
SeDeleteCodeIntegrityOriginClaimForFileObject();
goto LABEL_171;
}
return result;
}Referenced by:
No references.