ExpGetProcessInformation
NTSTATUS __stdcall ExpGetProcessInformation(
VOID *SystemInformation,
UINT64 SystemInformationLength,
UINT64 *Length,
UINT64 *SessionId,
_SYSTEM_INFORMATION_CLASS InformationClass){
int v6;
bool v7;
unsigned int v8;
unsigned __int8 v9;
PEPROCESS v10;
__int64 v11;
__int64 v12;
char *v13;
_EX_FAST_REF *p_Token;
void *v15;
_UNICODE_STRING *v16;
_QWORD *v17;
__int64 v18;
_EPROCESS *v19;
_PROCESS_DISK_COUNTERS *DiskCounters;
bool v21;
int v22;
unsigned int v23;
_OWORD *v24;
char *v25;
__int64 v26;
unsigned int v27;
char v28;
int v29;
_QWORD *p_Blink;
unsigned int v31;
__int64 v32;
int v33;
_OBJECT_NAME_INFORMATION *ImageFileName;
VOID **PoolWithTag;
VOID **v36;
__int64 *v37;
size_t v38;
char *v39;
__int64 v40;
_WORD *v41;
unsigned __int64 v42;
unsigned int v43;
unsigned int v44;
__int64 v45;
_QWORD *v46;
_ETHREAD *v47;
int v48;
__int64 *k;
bool v50;
NTSTATUS v51;
__int64 v52;
NTSTATUS v53;
__int64 v54;
__int64 v55;
_ETHREAD *CurrentThread;
_EPROCESS *v57;
_LIST_ENTRY *p_ThreadListHead;
int v59;
_LIST_ENTRY *i;
unsigned int v61;
unsigned int v62;
unsigned int v63;
int WaitTime_low;
unsigned __int64 v65;
unsigned __int64 v66;
_ETHREAD *v67;
_EPROCESS *v68;
_LIST_ENTRY *v69;
int v70;
_LIST_ENTRY *j;
_LIST_ENTRY *v72;
VOID *v73;
UINT64 v74;
UINT64 v75;
size_t v76;
unsigned int v77;
unsigned int v78;
unsigned int v79;
unsigned int v80;
volatile unsigned int ActiveThreads;
_LIST_ENTRY *Flink;
unsigned int v83;
_EX_PUSH_LOCK *p_ProcessLock;
NTSTATUS result;
signed __int32 v86;
UINT8 *Packaged;
NTSTATUS v88;
unsigned int v89;
unsigned int v90;
NTSTATUS v91;
char v92;
PVOID Object;
int v94;
_EPROCESS *Process;
UINT8 v96;
bool v97;
int v98;
PVOID v99;
int v100;
_DWORD *v101;
bool v102;
int v103;
char *v104;
_DWORD *v105;
UINT64 RequiredLength;
UINT64 *v107;
PVOID P;
UINT64 AppIdSize;
UINT64 PackageSize;
_SYSTEM_INFORMATION_CLASS v111;
__int64 v112;
__int64 *v113;
_WORD *v114;
char *v115;
__int64 *v116;
_LIST_ENTRY **v117;
_LIST_ENTRY **v118;
unsigned __int64 v119;
VOID *Handle;
_DWORD *v121;
NTSTATUS v122;
int v123;
_EJOB *Silo;
_KTHREAD *Thread;
PEPROCESS v126;
_KTHREAD_VALUES Values[2];
__int128 v128;
_ETHREAD *v129;
VOID *v130;
_ETHREAD *v131;
_ETHREAD *v132;
_EPROCESS_VALUES ProcessValues;
char UserSid[80];
char EnergyValues[432];
wchar_t AppId[72];
wchar_t PackageFullName[128];
unsigned int v138;
v138 = SystemInformationLength;
v111 = InformationClass;
v121 = SystemInformation;
v107 = Length;
AppIdSize = 130i64;
memset(EnergyValues, 0i64, sizeof(EnergyValues));
v103 = 0;
LODWORD(RequiredLength) = 0;
PackageSize = 254i64;
Process = 0i64;
memset(&ProcessValues, 0i64, sizeof(ProcessValues));
v96 = 0;
v99 = 0i64;
*(_OWORD *)&Values[0].WaitTime = 0i64;
v128 = 0i64;
v90 = 0;
memset(UserSid, 0i64, 0x44u);
if( Length )
*(_DWORD *)Length = 0;
v102 = v111 != SystemProcessInformation;
v6 = 136;
if( v111 == SystemProcessInformation )
v6 = 80;
v98 = v6;
v100 = v6;
v105 = v121;
v7 = v138 < 0x270;
if( v138 < 0x270 )
{
if( !Length )
return -1073741820;
v7 = v138 < 0x270;
}
v8 = v7 ? 0xC0000004 : 0;
v92 = 0;
v9 = KeGetCurrentThread()->$87BC921A506A176A34DE473FC146A343::gap0[10];
if( InformationClass != SystemFullProcessInformation
|| (result = ExCheckFullProcessInformationAccess(v9), result >= 0) )
{
if( (unsigned int)ExIsRestrictedCaller(v9) )
v92 = 1;
v91 = 0;
P = 0i64;
KeFlushProcessWriteBuffers(1u);
Silo = PsGetCurrentServerSilo();
v10 = *(PEPROCESS *)&PsIdleProcess;
Object = *(PVOID *)&PsIdleProcess;
Process = *(_EPROCESS **)&PsIdleProcess;
v88 = v8;
while( 1 )
{
LABEL_103:
if( !v10 )
{
if( v88 >= 0 && v105 && (*v105 = 0, v91 < 0) )
{
v88 = v91;
}
else if( v107 )
{
*(_DWORD *)v107 = v90;
}
goto LABEL_206;
}
if( (v10->Flags & 4) != 0 )
{
if( *(_DWORD *)&v10->Pcb.gap0[4] )
{
ActiveThreads = v10->ActiveThreads;
v10 = Process;
Object = Process;
if( !ActiveThreads && Process->Pcb.ThreadListHead.Flink == &Process->Pcb.ThreadListHead )
goto LABEL_82;
}
}
if( SessionId && v10 == *(PEPROCESS *)&PsIdleProcess )
goto LABEL_82;
v51 = MmGetSessionId(v10);
v122 = v51;
if( SessionId )
{
if( v51 != *(_DWORD *)SessionId )
goto LABEL_82;
}
if( !PsIsProcessInSilo(v10, Silo) )
goto LABEL_82;
v52 = (__int64)v121 + v90;
v101 = (_DWORD *)v52;
v105 = (_DWORD *)v52;
v94 = 624;
v31 = v90 + 624;
v89 = v90 + 624;
if( v90 + 624 < v90 )
{
v31 = -1;
v89 = -1;
v90 = -1;
v29 = -1073741675;
}
else
{
v90 += 624;
v29 = 0;
}
v91 = v29;
if( v29 < 0 )
{
v88 = v29;
LABEL_206:
p_Blink = v99;
goto LABEL_269;
}
memset(&ProcessValues, 0i64, sizeof(ProcessValues));
if( v31 > v138 )
{
v88 = -1073741820;
if( !v107 )
goto LABEL_206;
}
else
{
v53 = ExpCopyProcessInfo((_SYSTEM_PROCESS_INFORMATION *)v52, v10, v102, &ProcessValues);
v29 = v53;
v91 = v53;
if( v53 < 0 )
{
v88 = v53;
goto LABEL_206;
}
*(_QWORD *)v52 = 0i64;
*(_DWORD *)(v52 + 100) = v51;
*(_QWORD *)(v52 + 64) = 0i64;
*(_DWORD *)(v52 + 56) = 0;
if( v10 == *(PEPROCESS *)&PsIdleProcess )
*(_QWORD *)(v52 + 96) = 0i64;
if( v10 == PsSecureSystemProcess )
{
v54 = *(&stru_140C4DB30 + 66) << 12;
*(_QWORD *)(v52 + 144) = *(&stru_140C4DB30 + 66) << 12;
*(_QWORD *)(v52 + 8) = v54;
}
if( v29 < 0 )
{
v88 = v29;
goto LABEL_206;
}
}
v55 = v52 + 256;
v104 = (char *)(v52 + 256);
if( v10 == *(PEPROCESS *)&PsIdleProcess )
{
Flink = v10->Pcb.ThreadListHead.Flink;
if( Flink == &v10->Pcb.ThreadListHead )
{
p_Blink = 0i64;
}
else
{
p_Blink = &Flink[-48].Blink;
KeSynchronizeWithDynamicProcessors();
}
}
else
{
p_Blink = 0i64;
v118 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v132 = CurrentThread;
v57 = Process;
p_ThreadListHead = &Process->ThreadListHead;
v59 = 0;
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(&v57->ProcessLock, 0i64);
for( i = p_ThreadListHead->Flink; i != p_ThreadListHead; i = i->Flink )
{
p_Blink = &i[-79].Blink;
v118 = &i[-79].Blink;
if( ObReferenceObjectSafeWithTag((INT64)&i[-79].Blink, 1850045264i64) )
{
v59 = 1;
break;
}
}
if( _InterlockedCompareExchange64(&v57->ProcessLock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&v57->ProcessLock);
KeAbPostRelease(&v57->ProcessLock);
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
if( !v59 )
{
p_Blink = 0i64;
v118 = 0i64;
}
v10 = Process;
Object = Process;
v29 = v91;
v31 = v90;
v89 = v90;
v52 = (__int64)v105;
v101 = v105;
v55 = (__int64)v104;
}
v99 = p_Blink;
while( p_Blink )
{
v123 = *((_DWORD *)p_Blink + 1);
if( !(_BYTE)v123 )
{
v61 = v31 + v98;
if( v31 + v98 < v31 )
{
v61 = -1;
v29 = -1073741675;
}
else
{
v29 = 0;
}
v90 = v61;
v89 = v61;
v62 = v61;
v91 = v29;
if( v29 < 0 )
{
v88 = v29;
goto LABEL_269;
}
v63 = v98;
v94 += v98;
if( v61 > v138 )
{
v88 = -1073741820;
if( !v107 )
goto LABEL_269;
}
else
{
KeQueryValuesThread((_KTHREAD *)p_Blink, Values);
WaitTime_low = LOBYTE(Values[1].WaitTime);
if( LOBYTE(Values[1].WaitTime) == 4 )
{
v94 -= v63;
v89 = v62 - v63;
v90 = v62 - v63;
}
else
{
*(_DWORD *)(v55 + 24) = Values[0].WaitTime;
*(_DWORD *)(v55 + 68) = WaitTime_low;
*(_DWORD *)(v55 + 72) = BYTE1(Values[1].WaitTime);
*(_DWORD *)(v55 + 56) = SBYTE2(Values[1].WaitTime);
*(_DWORD *)(v55 + 60) = SHIBYTE(Values[1].WaitTime);
*(_QWORD *)v55 = (unsigned int)KeMaximumIncrement * (unsigned __int64)*((unsigned int *)p_Blink + 163);
*(_QWORD *)(v55 + 8) = (unsigned int)KeMaximumIncrement
* (unsigned __int64)*((unsigned int *)p_Blink + 183);
*(_QWORD *)(v55 + 16) = p_Blink[134];
*(_DWORD *)(v55 + 64) = *((_DWORD *)p_Blink + 85);
*(_OWORD *)(v55 + 40) = *(_OWORD *)(p_Blink + 143);
if( (*((_DWORD *)p_Blink + 29) & 0x400) != 0 )
{
v65 = p_Blink[154];
}
else
{
if( (p_Blink[163] & 8) != 0
|| (v65 = *((_QWORD *)v99 + 138), _InterlockedOr(&v86, 0), (p_Blink[163] & 8) != 0) )
{
v65 = 0i64;
}
v10 = Process;
Object = Process;
v29 = v91;
p_Blink = v99;
v89 = v90;
v52 = (__int64)v105;
v101 = v105;
v55 = (__int64)v104;
}
v119 = v65;
if( v92 && v65 > 0x7FFFFFFEFFFFi64 )
*(_QWORD *)(v55 + 32) = 0i64;
else
*(_QWORD *)(v55 + 32) = v65;
if( v111 != SystemProcessInformation )
{
if( v92 )
{
*(_QWORD *)(v55 + 80) = 0i64;
*(_QWORD *)(v55 + 88) = 0i64;
}
else
{
*(_QWORD *)(v55 + 80) = p_Blink[7];
*(_QWORD *)(v55 + 88) = p_Blink[6];
v10 = Process;
Object = Process;
v29 = v91;
p_Blink = v99;
v89 = v90;
v52 = (__int64)v105;
v101 = v105;
v55 = (__int64)v104;
}
v66 = p_Blink[154];
v119 = v66;
if( v92 && v66 > 0x7FFFFFFEFFFFi64 )
*(_QWORD *)(v55 + 96) = 0i64;
else
*(_QWORD *)(v55 + 96) = v66;
*(_QWORD *)(v55 + 104) = p_Blink[30];
*(_QWORD *)(v55 + 112) = 0i64;
*(_QWORD *)(v55 + 120) = 0i64;
*(_QWORD *)(v55 + 128) = 0i64;
}
++*(_DWORD *)(v52 + 4);
if( v29 < 0 )
{
v88 = v29;
goto LABEL_269;
}
v55 += v63;
v104 = (char *)v55;
}
}
}
if( v10 == *(PEPROCESS *)&PsIdleProcess )
{
v72 = (_LIST_ENTRY *)p_Blink[95];
if( v72 != &v10->Pcb.ThreadListHead )
{
p_Blink = &v72[-48].Blink;
KeSynchronizeWithDynamicProcessors();
goto LABEL_167;
}
p_Blink = 0i64;
v99 = 0i64;
v31 = v89;
}
else
{
p_Blink = 0i64;
v117 = 0i64;
v67 = (_ETHREAD *)KeGetCurrentThread();
v129 = v67;
v68 = Process;
v69 = &Process->ThreadListHead;
v70 = 0;
--v67->Tcb.KernelApcDisable;
ExAcquirePushLockSharedEx(&v68->ProcessLock, 0i64);
for( j = (_LIST_ENTRY *)*((_QWORD *)v99 + 157); j != v69; j = j->Flink )
{
p_Blink = &j[-79].Blink;
v117 = &j[-79].Blink;
if( ObReferenceObjectSafeWithTag((INT64)&j[-79].Blink, 1850045264i64) )
{
v70 = 1;
break;
}
}
if( _InterlockedCompareExchange64(&v68->ProcessLock._bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(&v68->ProcessLock);
KeAbPostRelease(&v68->ProcessLock);
KeLeaveCriticalRegionThread(&v67->Tcb);
ObfDereferenceObjectWithTag(v99, 0x6E457350ui64);
if( !v70 )
p_Blink = 0i64;
v117 = (_LIST_ENTRY **)p_Blink;
v10 = Process;
Object = Process;
v29 = v91;
v89 = v90;
v52 = (__int64)v105;
v101 = v105;
v55 = (__int64)v104;
LABEL_167:
v99 = p_Blink;
v31 = v89;
}
}
v11 = v55;
v112 = v55;
v12 = v55;
v13 = (char *)(v55 + 368);
v104 = v13;
if( v88 < 0 )
goto LABEL_48;
p_Token = &v10->Token;
v15 = ObFastReferenceObject(p_Token);
if( v15 )
{
v17 = Object;
}
else
{
Thread = (_ETHREAD *)KeGetCurrentThread();
--Thread->Tcb.KernelApcDisable;
p_ProcessLock = &Process->ProcessLock;
ExAcquirePushLockSharedEx(&Process->ProcessLock, 0i64);
v15 = ObFastReferenceObjectLocked(p_Token);
if( _InterlockedCompareExchange64(&p_ProcessLock->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(p_ProcessLock);
KeAbPostRelease(p_ProcessLock);
KeLeaveCriticalRegionThread(&Thread->Tcb);
v17 = Process->Pcb.gap0;
v11 = v112;
}
v96 = SeSecurityAttributePresent(v15, (_UNICODE_STRING *)&PspSysAppIdClaim, v16);
ObFastDereferenceObject(p_Token, v15);
*(_QWORD *)(v11 + 52) = 0i64;
*(_DWORD *)(v11 + 336) = 0;
v18 = v112;
*(_QWORD *)(v112 + 344) = v17[293] << 12;
*(_QWORD *)(v18 + 40) = ProcessValues.ContextSwitches;
*(_DWORD *)(v18 + 48) = 0;
if( v96 )
*(_DWORD *)(v18 + 48) = 1;
v19 = Process;
DiskCounters = Process->DiskCounters;
if( DiskCounters )
{
*(_OWORD *)v18 = *(_OWORD *)&DiskCounters->BytesRead;
*(_OWORD *)(v18 + 16) = *(_OWORD *)&DiskCounters->ReadOperationCount;
*(_QWORD *)(v18 + 32) = DiskCounters->FlushOperationCount;
}
else
{
*(_OWORD *)v18 = 0i64;
*(_OWORD *)(v18 + 16) = 0i64;
*(_QWORD *)(v18 + 32) = 0i64;
}
if( (v19->Flags3 & 0x1000) != 0 )
{
v23 = *(_DWORD *)(v18 + 48) & 0xFFFFFFE1 | 2;
}
else if( v19 == PsSecureSystemProcess )
{
v23 = *(_DWORD *)(v18 + 48) & 0xFFFFFFE1 | 4;
}
else if( (unsigned int)SmIsCompressionProcess(v19) )
{
v23 = *(_DWORD *)(v18 + 48) & 0xFFFFFFE1 | 6;
}
else
{
v21 = *(&CmpDummyThreadEvent + 5) && v19 == (_EPROCESS *)*(&CmpDummyThreadEvent + 5);
v97 = v21;
v22 = *(_DWORD *)(v18 + 48);
if( v21 )
v23 = v22 & 0xFFFFFFE1 | 8;
else
v23 = v22 & 0xFFFFFFE1;
}
*(_DWORD *)(v18 + 48) = v23;
*(_QWORD *)(v18 + 360) = v19->SequenceNumber;
PsQueryProcessEnergyValues(v19, (_PROCESS_ENERGY_VALUES *)EnergyValues);
v24 = (_OWORD *)(v18 + 64);
v25 = EnergyValues;
v26 = 2i64;
do
{
*v24 = *(_OWORD *)v25;
v24[1] = *((_OWORD *)v25 + 1);
v24[2] = *((_OWORD *)v25 + 2);
v24[3] = *((_OWORD *)v25 + 3);
v24[4] = *((_OWORD *)v25 + 4);
v24[5] = *((_OWORD *)v25 + 5);
v24[6] = *((_OWORD *)v25 + 6);
v24 += 8;
*(v24 - 1) = *((_OWORD *)v25 + 7);
v25 += 128;
--v26;
}
while( v26 );
*v24 = *(_OWORD *)v25;
if( v19->Job )
*(_DWORD *)(v12 + 352) = *((_DWORD *)v19->Job + 309);
else
*(_DWORD *)(v12 + 352) = 0;
v10 = Process;
Object = Process;
if( Process->Pcb.ProcessTimerDelay
|| KeHeteroSystem
&& ((v27 = KiProcessPolicyToQosMappingTable[((unsigned __int32)Process->Pcb._bf_0 >> 7) & 7], v27 != 5)
|| Process->PriorityClass != 1 ? (v28 = 0) : (v28 = 1),
PpmPerfQosEnabled && (v27 - 1 <= 1 || v28)) )
{
*(_DWORD *)(v18 + 48) |= 0x20u;
}
v29 = v91;
if( v91 < 0 )
{
v88 = v91;
goto LABEL_206;
}
v11 = v112;
p_Blink = v99;
v31 = v90;
v89 = v90;
v101 = v105;
v13 = v104;
LABEL_48:
if( InformationClass == SystemFullProcessInformation )
{
v73 = PsReferencePrimaryToken(v10);
v130 = v73;
SeQueryUserSidToken(v73, UserSid, 0x44ui64, &RequiredLength);
PackageSize = 254i64;
AppIdSize = 130i64;
v29 = 0;
v91 = RtlQueryPackageIdentity(v73, PackageFullName, &PackageSize, AppId, &AppIdSize, 0i64);
if( v91 >= 0 )
{
v75 = AppIdSize;
v74 = PackageSize;
}
else
{
v74 = 0i64;
PackageSize = 0i64;
v75 = 0i64;
AppIdSize = 0i64;
}
ObFastDereferenceObject((_EX_FAST_REF *)Object + 151, v73);
v76 = RequiredLength;
v77 = (RequiredLength + 7) & 0xFFFFFFF8;
v103 = v77;
v78 = v77 + v89;
if( v77 + v89 < v89 )
{
v78 = -1;
v29 = -1073741675;
}
v90 = v78;
v89 = v78;
v79 = v78;
v91 = v29;
if( v29 < 0 )
{
v88 = v29;
}
else
{
v94 += v77;
if( v78 > v138 )
{
v88 = -1073741820;
if( !v107 )
goto LABEL_269;
}
else
{
*(_DWORD *)(v11 + 52) = 368;
memmove(v13, UserSid, v76);
v79 = v89;
v13 += v77;
v104 = v13;
}
if( v74 )
{
if( v74 > 0xFFFFFFFF )
{
v88 = -1073741820;
}
else
{
v103 = v74;
if( (unsigned int)v74 + v79 < v79 )
{
v80 = -1;
v89 = -1;
v90 = -1;
v29 = -1073741675;
}
else
{
v80 = v74 + v79;
v89 = v74 + v79;
v90 = v74 + v79;
v29 = 0;
}
v91 = v29;
if( v29 >= 0 )
{
v94 += v74;
if( v80 > v138 )
{
v88 = -1073741820;
if( !v107 )
goto LABEL_269;
}
else
{
*(_DWORD *)(v11 + 56) = (_DWORD)v13 - v11;
memmove(v13, PackageFullName, v74);
v80 = v89;
v13 += (unsigned int)v74;
v104 = v13;
}
goto LABEL_188;
}
v88 = v29;
}
}
else
{
v80 = v89;
LABEL_188:
if( !v75 )
{
v31 = v89;
v10 = (PEPROCESS)Object;
goto LABEL_49;
}
v83 = -1;
if( v75 > 0xFFFFFFFF )
{
v88 = -1073741820;
}
else
{
v103 = v75;
if( (unsigned int)v75 + v80 < v80 )
{
v89 = -1;
v90 = -1;
v29 = -1073741675;
}
else
{
v83 = v75 + v80;
v89 = v75 + v80;
v90 = v75 + v80;
v29 = 0;
}
v91 = v29;
if( v29 >= 0 )
{
v94 += v75;
if( v83 > v138 )
{
v88 = -1073741820;
if( !v107 )
goto LABEL_269;
v31 = v89;
v10 = (PEPROCESS)Object;
}
else
{
*(_DWORD *)(v11 + 336) = (_DWORD)v13 - v11;
memmove(v13, AppId, v75);
v10 = (PEPROCESS)Object;
v13 += (unsigned int)v75;
v104 = v13;
v31 = v89;
}
goto LABEL_49;
}
v88 = v29;
}
}
}
LABEL_269:
if( Object && Object != *(PVOID *)&PsIdleProcess )
ObfDereferenceObjectWithTag(Object, 0x6E457350ui64);
if( p_Blink && p_Blink[68] != *(_QWORD *)&PsIdleProcess )
ObfDereferenceObjectWithTag(p_Blink, 0x6E457350ui64);
if( P )
ExFreePoolWithTag(P, 0);
return v88;
}
LABEL_49:
if( v10 == *(PEPROCESS *)&PsIdleProcess )
goto LABEL_174;
if( v10 == PsInitialSystemProcess )
{
v37 = &ExpSystemProcessName;
}
else if( v10 == PsSecureSystemProcess )
{
v37 = &ExpSecureSystemProcessName;
}
else if( (unsigned int)SmIsCompressionProcess(v10) )
{
v37 = (__int64 *)L"$&";
}
else
{
v33 = -1073741275;
if( v10->PicoContext && (_QWORD)xmmword_140C1DE80 )
{
v33 = ((__int64(__fastcall *)(__int64, PVOID *))xmmword_140C1DE80)(v32, &P);
}
else
{
ImageFileName = v10->SeAuditProcessCreationInfo.ImageFileName;
if( ImageFileName )
{
PoolWithTag = ExAllocatePoolWithTag(
0x200ui64,
*((unsigned __int16 *)ImageFileName + 1) + 16i64,
1850307408i64);
v36 = PoolWithTag;
if( PoolWithTag )
{
*(_OWORD *)PoolWithTag = *(_OWORD *)ImageFileName;
if( PoolWithTag[1] )
{
PoolWithTag[1] = PoolWithTag + 2;
memmove(PoolWithTag + 2, *((const VOID **)ImageFileName + 1), *((unsigned __int16 *)ImageFileName + 1));
}
P = v36;
v33 = 0;
}
else
{
v33 = -1073741801;
}
}
v10 = (PEPROCESS)Object;
}
v91 = v33;
if( v33 < 0 )
v37 = (__int64 *)v10->SeAuditProcessCreationInfo.ImageFileName;
else
v37 = (__int64 *)P;
}
v113 = v37;
v38 = *(unsigned __int16 *)v37;
v103 = v38;
v39 = v13;
v115 = v13;
LODWORD(RequiredLength) = v38;
v40 = v37[1];
v41 = (_WORD *)v40;
v114 = (_WORD *)v40;
if( InformationClass != SystemFullProcessInformation && v38 )
{
v41 = (_WORD *)(v40 + 2 * ((unsigned __int64)v38 >> 1));
v114 = v41;
while( v41 != (_WORD *)v40 )
{
v114 = --v41;
if( *v41 == 92 )
{
v114 = ++v41;
break;
}
}
v38 -= 2 * (((__int64)v41 - v40) >> 1);
LODWORD(RequiredLength) = v38;
}
v42 = v38;
v43 = (v38 + 9) & 0xFFFFFFF8;
v103 = v43;
v44 = v43 + v31;
if( v43 + v31 < v31 )
{
v44 = -1;
v29 = -1073741675;
}
else
{
v29 = 0;
}
v90 = v44;
v91 = v29;
if( v29 < 0 )
{
v88 = v29;
goto LABEL_269;
}
v94 += v43;
if( v44 > v138 )
{
v88 = -1073741820;
if( !v107 )
goto LABEL_269;
}
else
{
if( v38 )
{
memmove(v13, v41, v38);
v39 = &v13[2 * (v42 >> 1)];
v115 = v39;
}
*(_WORD *)v39 = 0;
v39 += 2;
v115 = v39;
}
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
if( v88 < 0 )
{
v10 = (PEPROCESS)Object;
LABEL_174:
v45 = (__int64)v101;
goto LABEL_80;
}
v45 = (__int64)v101;
*((_WORD *)v101 + 28) = (_WORD)v39 - (_WORD)v13 - 2;
*(_WORD *)(v45 + 58) = v43;
*(_QWORD *)(v45 + 64) = v13;
v10 = (PEPROCESS)Object;
LABEL_80:
if( v88 >= 0 )
{
*(_DWORD *)v45 = v94;
if( v29 < 0 )
{
v88 = v29;
goto LABEL_269;
}
}
LABEL_82:
if( v10 == *(PEPROCESS *)&PsIdleProcess )
v10 = 0i64;
v46 = v10->Pcb.gap0;
v126 = v10;
Handle = 0i64;
while( 1 )
{
Object = 0i64;
v116 = 0i64;
v47 = (_ETHREAD *)KeGetCurrentThread();
v131 = v47;
v48 = 0;
--v47->Tcb.SpecialApcDisable;
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&PspActiveProcessLock, 0i64);
for( k = (__int64 *)(v46 ? v46[137] : PsActiveProcessHead); k != &PsActiveProcessHead; k = (__int64 *)*k )
{
Object = k - 137;
v116 = k - 137;
if( ObReferenceObjectSafeWithTag((INT64)(k - 137), 1850045264i64) )
{
v48 = 1;
break;
}
}
if( _InterlockedCompareExchange64((volatile signed __int64 *)&PspActiveProcessLock, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((_EX_PUSH_LOCK *)&PspActiveProcessLock);
KeAbPostRelease(&PspActiveProcessLock);
v50 = v47->Tcb.SpecialApcDisable++ == -1;
if( v50 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v47->Tcb.ApcState.ApcListHead[0].Flink != &v47->Tcb.152 )
KiCheckForKernelApcDelivery();
if( v46 )
ObfDereferenceObjectWithTag(v46, 0x6E457350ui64);
if( v48 )
{
v10 = (PEPROCESS)Object;
}
else
{
v10 = 0i64;
Object = 0i64;
v116 = 0i64;
}
v46 = v10->Pcb.gap0;
v126 = v10;
if( !v10 )
break;
if( (v10->Flags & 0x4000000) != 0 )
{
if( !v92 )
goto LABEL_102;
LOBYTE(Packaged) = 1;
if( ObOpenObjectByPointer(
v10,
0x200ui64,
0i64,
1024,
(POBJECT_TYPE)PsProcessType,
(_KPROCESSOR_MODE)Packaged,
&Handle) >= 0 )
{
ObCloseHandle(Handle, 0);
LABEL_102:
Process = v10;
goto LABEL_103;
}
}
}
v10 = 0i64;
Object = 0i64;
Process = 0i64;
}
}
return result;
}Referenced by:
ExpQuerySystemInformation