MmEnumerateAddressSpaceAndReferenceImages
INT64 __fastcall MmEnumerateAddressSpaceAndReferenceImages(ULONG_PTR BugCheckParameter1, char a2){
int v5;
int v6;
_ETHREAD *CurrentThread;
unsigned int v8;
INT64 v9;
__int64 v10;
INT64 v11;
_QWORD *v12;
INT64 v13;
_QWORD *i;
_QWORD **v15;
INT64 v16;
_QWORD *v17;
_QWORD *v18;
int v19;
INT64 v20;
int v21;
_CONTROL_AREA *v22;
unsigned __int64 v23;
unsigned __int64 v24;
__int64 v26;
unsigned __int64 v27;
int v28;
int v29;
int v30;
unsigned __int64 v31;
__int64 v32;
unsigned __int64 v33;
int v34;
_KAPC_STATE ApcState;
v5 = a2 & 1;
memset(&ApcState, 0, 32);
v6 = v5 | 2;
if( (a2 & 2) == 0 )
v6 = v5;
*(_OWORD *)&ApcState.Process = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v8 = v6 | 4;
if( (a2 & 4) == 0 )
v8 = v6;
v9 = 0i64;
if( *((_QWORD *)CurrentThread + 23) == BugCheckParameter1 )
{
v34 = 0;
}
else
{
KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
v34 = 1;
}
LOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)BugCheckParameter1);
v10 = *(_QWORD *)(BugCheckParameter1 + 2024);
if( v10 )
{
if( (unsigned __int64)(v10 + 1) <= 0x555555555555555i64 )
{
LODWORD(v11) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
v9 = v11;
if( v11 )
{
v12 = *(_QWORD **)(BugCheckParameter1 + 2008);
v13 = v11;
i = 0i64;
while( v12 )
{
i = v12;
v12 = (_QWORD *)*v12;
}
while( 1 )
{
while( 1 )
{
if( !i )
{
*(_QWORD *)v13 = 0i64;
goto LABEL_38;
}
v15 = (_QWORD **)i[1];
v16 = (INT64)i;
v17 = i;
if( v15 )
{
v18 = *v15;
for( i = (_QWORD *)i[1]; v18; v18 = (_QWORD *)*v18 )
i = v18;
}
else
{
while( 1 )
{
i = (_QWORD *)(i[2] & 0xFFFFFFFFFFFFFFFCui64);
if( !i || (_QWORD *)*i == v17 )
break;
v17 = i;
}
}
MiLockVadShared((INT64)CurrentThread, v16);
if( (unsigned int)MiVadDeleted(v16) == 1 || v21 == 1 )
goto LABEL_15;
if( (v19 & 0x100000) == 0 )
break;
if( v8 >= 4 )
{
*(_QWORD *)v13 = (*(unsigned int *)(v16 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 32) << 32)) << 12;
*(_QWORD *)(v13 + 8) = ((*(unsigned int *)(v16 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 33) << 32))
- (*(unsigned int *)(v16 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 32) << 32))
+ 1) << 12;
v26 = *(unsigned int *)(v16 + 52);
LODWORD(v26) = v26 & 0x7FFFFFFF;
if( (v26 | ((unsigned __int64)*(unsigned __int8 *)(v16 + 34) << 31)) < 0x7FFFFFFFDi64 )
v27 = (v26 | ((unsigned __int64)*(unsigned __int8 *)(v16 + 34) << 31)) << 12;
else
v27 = 0i64;
*(_QWORD *)(v13 + 24) = v27;
*(_DWORD *)(v13 + 16) = *(_DWORD *)(BugCheckParameter1 + 1088);
*(_DWORD *)(v13 + 20) = 0x2000;
v28 = v21 - 3;
if( v28 )
{
if( v28 == 1 )
{
*(_DWORD *)(v13 + 20) = 8396800;
v30 = 8396800;
}
else
{
v29 = *(_DWORD *)(v16 + 48);
v30 = 0x2000;
if( (v29 & 0x100000) != 0 && ((v29 & 0x400000) != 0 || (v29 & 0xC0000u) >= 0x80000) )
{
*(_DWORD *)(v13 + 20) = 536879104;
v30 = 536879104;
}
}
}
else if( (*(_DWORD *)(v16 + 48) & 0x3100000) == 34603008 )
{
v30 = 0x2000;
}
else
{
*(_DWORD *)(v13 + 20) = 4202496;
v30 = 4202496;
}
if( (*(_DWORD *)(v16 + 48) & 0x300000) == 3145728 )
*(_DWORD *)(v13 + 20) = v30 | 0x200000;
v33 = *(_QWORD *)v13 & 0xFFFFFFFFFFFFFFFCui64 | 2;
goto LABEL_58;
}
LABEL_15:
MiUnlockVadShared((INT64)CurrentThread, v16);
}
if( v21 != 2 || (v19 & 0xF80) != 896 || (v8 & 1) == 0 )
{
if( (v8 & 2) != 0 )
{
MiFillMapFileInfo(v20, v13);
v33 = *(_QWORD *)v13 & 0xFFFFFFFFFFFFFFFCui64 | 1;
LABEL_58:
*(_QWORD *)v13 = v33;
goto LABEL_33;
}
goto LABEL_15;
}
v22 = **(_CONTROL_AREA ***)(v16 + 72);
*(_QWORD *)v13 = MiReferenceControlAreaFile(v22);
*(_QWORD *)(v13 + 8) = (*(unsigned int *)(v16 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 32) << 32)) << 12;
*(_QWORD *)(v13 + 16) = *(_QWORD *)(*(_QWORD *)v22 + 32i64);
*(_QWORD *)(v13 + 24) = ((*(unsigned int *)(v16 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 33) << 32))
- (*(unsigned int *)(v16 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 32) << 32))
+ 1) << 12;
*(_DWORD *)(v13 + 40) = *(_DWORD *)(*(_QWORD *)(*(_QWORD *)v22 + 56i64) + 60i64);
if( (*(_DWORD *)(v16 + 64) & 0x8000000) != 0 )
{
v24 = *(_QWORD *)(v13 + 8) & 0xFFFFFFFFFFFFE03Fui64;
}
else
{
v23 = *(_QWORD *)(v13 + 8) & 0xFFFFFFFFFFFFFC3Fui64 | (4i64 * (*(_BYTE *)(*(_QWORD *)v22 + 15i64) & 0xF0));
*(_QWORD *)(v13 + 8) = v23;
v24 = v23 ^ ((unsigned __int16)v23 ^ (unsigned __int16)(*(unsigned __int8 *)(*(_QWORD *)v22 + 15i64) << 9)) & 0x1C00;
}
*(_QWORD *)(v13 + 8) = v24;
if( (v8 & 2) != 0 )
{
v31 = HIBYTE(*(_DWORD *)(v16 + 64)) & 1 | *(_QWORD *)(v13 + 8) & 0xFFFFFFFFFFFFFFFEui64;
*(_QWORD *)(v13 + 8) = v31;
*(_QWORD *)(v13 + 8) = v31 ^ ((unsigned __int8)v31 ^ (unsigned __int8)((unsigned __int64)*(unsigned int *)(v16 + 48) >> 6)) & 0x3E;
v32 = *(unsigned int *)(v16 + 52);
LODWORD(v32) = v32 & 0x7FFFFFFF;
*(_QWORD *)(v13 + 32) = (v32 | ((unsigned __int64)*(unsigned __int8 *)(v16 + 34) << 31)) << 12;
}
LABEL_33:
MiUnlockVadShared((INT64)CurrentThread, v16);
v13 += 48i64;
}
}
}
}
LABEL_38:
UNLOCK_ADDRESS_SPACE_SHARED((__int64)CurrentThread, BugCheckParameter1);
if( v34 == 1 )
KiUnstackDetachProcess(&ApcState, 0i64);
return v9;
}Referenced by:
EtwpCovSampEnumerateProcess
EtwpEnumerateAddressSpace