CmpAddStringToMapping
__int64 __fastcall CmpAddStringToMapping(const void **a1, __int64 a2){
unsigned int v4;
char *v5;
__int64 v6;
UINT8 *v7;
int v8;
char *v9;
__int64 v10;
PVOID v12;
void *PoolWithTag;
v4 = 0;
ExAcquireFastMutex(&CmpSIDMappingLock);
if( CmpSIDToHiveMappingCount == -1 )
{
v4 = -1073741675;
goto LABEL_5;
}
if( CmpSIDToHiveMappingCount + 1 >= (unsigned int)CmpSIDToHiveMappingSize )
{
v12 = CmpSIDToHiveMapping;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 32i64 * (unsigned int)(CmpSIDToHiveMappingSize + 4), 0x65564D43ui64);
CmpSIDToHiveMapping = PoolWithTag;
if( !PoolWithTag )
{
CmpSIDToHiveMapping = v12;
goto LABEL_11;
}
CmpSIDToHiveMappingSize += 4;
if( v12 )
{
memmove((UINT8 *)PoolWithTag, (UINT8 *)v12, 32i64 * (unsigned int)CmpSIDToHiveMappingCount);
ExFreePoolWithTag(v12, 0x65564D43u);
}
}
v5 = (char *)CmpSIDToHiveMapping;
v6 = 32i64 * (unsigned int)CmpSIDToHiveMappingCount;
*(_QWORD *)((char *)CmpSIDToHiveMapping + v6 + 24) = a2;
*(_WORD *)&v5[v6] = *(_WORD *)a1;
*(_WORD *)&v5[v6 + 2] = *(_WORD *)a1;
v7 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, *(unsigned __int16 *)a1, 0x65564D43ui64);
v8 = CmpSIDToHiveMappingCount;
v9 = (char *)CmpSIDToHiveMapping;
v10 = 32i64 * (unsigned int)CmpSIDToHiveMappingCount;
*(_QWORD *)((char *)CmpSIDToHiveMapping + v10 + 8) = v7;
if( !v7 )
{
LABEL_11:
v4 = -1073741670;
goto LABEL_5;
}
memmove(v7, (UINT8 *)a1[1], *(unsigned __int16 *)a1);
*(_DWORD *)&v9[v10 + 16] = CmpHashUnicodeComponent((const UNICODE_STRING *)a1);
CmpSIDToHiveMappingCount = v8 + 1;
LABEL_5:
KeReleaseGuardedMutex(&CmpSIDMappingLock);
return v4;
}Referenced by:
CmpVEAddHiveToSIDMappingTable