NtSetInformationProcess
NTSTATUS __stdcall NtSetInformationProcess(
PVOID ProcessHandle,
_PROCESSINFOCLASS ProcessInformationClass,
PVOID ProcessInformation,
UINT64 ProcessInformationLength){
UINT64 v4;
__int64 v5;
unsigned int v7;
_ETHREAD *CurrentThread;
unsigned __int8 v9;
int v10;
NTSTATUS result;
volatile signed __int64 *v12;
NTSTATUS v13;
char *PoolWithTag;
INT64 v15;
void *v16;
PVOID v17;
int v18;
unsigned __int8 v19;
_KPROCESS *v20;
__int16 v21;
PVOID v22;
NTSTATUS v23;
char v24;
int v25;
NTSTATUS v26;
struct _EX_RUNDOWN_REF *v27;
_QWORD *i;
unsigned int v29;
unsigned int v30;
int v31;
struct _EX_RUNDOWN_REF *v32;
signed __int64 *v33;
signed __int64 v34;
signed __int64 v35;
struct _DMA_ADAPTER *v36;
int v37;
PVOID v38;
_EPROCESS *v39;
UINT64 v40;
unsigned __int8 v41;
__int64 v42;
_DWORD *v43;
__int64 v44;
__int16 v45;
__int64 v46;
int v47;
PVOID v48;
__int64 v49;
unsigned __int64 v50;
__int64 v51;
NTSTATUS v52;
PVOID v53;
_BOOL8 v54;
NTSTATUS v55;
struct _EX_RUNDOWN_REF *v56;
__int64 v57;
struct _EX_RUNDOWN_REF *Count;
void **v59;
struct _EX_RUNDOWN_REF *v60;
int v61;
HANDLE v62;
int v63;
int v64;
PVOID v65;
int v66;
int v67;
int v68;
PVOID v69;
_PROCESS_HANDLE_TRACING_ENABLE_EX *v70;
NTSTATUS v71;
NTSTATUS v72;
unsigned int v73;
unsigned __int64 v74;
NTSTATUS v75;
volatile signed __int32 *v76;
__int64 v77;
signed __int32 v78;
int v79;
signed __int32 v80;
char *v81;
KSPIN_LOCK *v82;
int v83;
unsigned int v84;
_EPROCESS *CurrentProcess;
int v86;
unsigned int v87;
NTSTATUS v88;
struct _EX_RUNDOWN_REF *v89;
__int64 v90;
unsigned int v91;
signed __int32 v92;
signed __int32 v93;
PVOID v94;
char *v95;
char *v96;
int v97;
unsigned __int64 v98;
__int128 *PoolWithQuotaTag;
int v100;
__int64 v101;
unsigned int v102;
_DWORD *v103;
_QWORD *v104;
__int64 v105;
__int16 v106;
__int64 v107;
_QWORD *j;
_QWORD *v109;
__int64 v110;
UINT8 *v111;
UINT8 *v112;
__int64 v113;
__int64 v114;
VOID **v115;
__int64 v116;
void *Ptr;
__int64 v118;
__int64 v119;
__int64 Ptr_high;
unsigned __int64 v121;
UINT64 v122;
int v123;
unsigned __int64 v124;
unsigned __int64 v125;
unsigned __int64 v126;
__int64 v127;
__int64 v128;
unsigned __int64 v129;
_QWORD *v130;
char v131;
unsigned __int64 v132;
__int16 v133;
bool v134;
__int64 v135;
__int16 v136;
__int64 v137;
volatile signed __int32 *v138;
__int16 v139;
__int64 v140;
__int64 *v141;
char *v142;
INT64 v143;
char v144;
unsigned int v145;
struct _DMA_ADAPTER *v146;
HANDLE v147;
UINT64 v148;
__int64 v149;
int v150;
int v151;
_HANDLE_TABLE *v152;
unsigned int v153;
int v154;
int v155;
unsigned int v156;
int v157;
PVOID v158;
UINT64 *v159;
int v160;
char IsSandboxedToken;
int v162;
int v163;
unsigned int v164;
UINT64 v165;
bool v166;
int v167;
int v168;
int v169;
int v170;
int v171;
int v172;
int v173;
unsigned int v174;
int v175;
int v176;
unsigned int v177;
UINT64 v178;
unsigned int v179;
int v180;
unsigned int v181;
int v182;
int v183;
int v184;
int v185;
UINT64 v186;
unsigned int v187;
int NoChildProcessRestrictedPolicy;
int v189;
int v190;
int v191;
int v192;
unsigned int v193;
int RedirectionTrustPolicy;
int v195;
int v196;
int v197;
__int64 v198;
unsigned int v199;
int v200;
int v201;
int v202;
int v203;
int v204;
int v205;
int v206;
char v207;
struct _EX_RUNDOWN_REF *v208;
_HANDLE_TABLE *v209;
void *v210;
int v211;
void *v212;
unsigned __int64 v213;
void *v214;
PVOID v215;
NTSTATUS v216;
_BOOL8 v217;
PVOID v218;
unsigned int v219;
ULONG v220;
UINT8 v221;
NTSTATUS v222;
int v223;
__int64 v224;
char v225;
int v226;
UINT64 ExtensionTable;
int v228;
unsigned int v229;
PVOID v230;
NTSTATUS v231;
__int128 v232;
int v233;
volatile signed __int32 *v234;
unsigned int v235;
volatile signed __int32 *v236;
int v237;
char v238;
unsigned int v239;
PVOID v240;
UINT64 v241;
HANDLE v242;
NTSTATUS v243;
__int64 v244;
__int64 v245;
__int64 v246;
__int64 *v247;
int v248;
int v249;
unsigned int v250;
int v251;
unsigned int v252;
NTSTATUS v253;
_DWORD *v254;
unsigned int v255;
UINT8 *v256;
_DWORD *v257;
_DWORD *Pool2;
unsigned int v259;
UINT8 *v260;
_EPROCESS *v261;
_DWORD *v262;
int v263[8];
ULONG Tag[2];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
INT64 v267;
PVOID v268;
PADAPTER_OBJECT v269;
INT64 a11;
UINT64 v271;
INT64 v272;
UINT8 *CapturedSid;
int v274;
HANDLE Handle;
__int16 v276;
unsigned int v277;
ULONG Alignment;
char v279;
char v280;
UINT8 v281;
char v282;
int v283;
UINT8 *v284;
__int64 v285;
PEX_RUNDOWN_REF RunRef;
int v287[2];
__int64 v288;
__int64 v289;
size_t Size;
PVOID BugCheckParameter1;
PVOID v292;
PVOID v293;
__int64 v294;
__int64 v295;
__int128 v296;
unsigned int v297;
int v298;
unsigned int v299;
char v300[12];
GROUP_AFFINITY GroupAffinity;
void *Src[2];
volatile void *Address[2];
UINT8 *v304[2];
PVOID v305;
PVOID v306;
__int64 v307;
INT64 v308;
PVOID v309;
PADAPTER_OBJECT DmaAdapter;
int v311;
int v312;
int v313;
int v314;
int v315;
int v316;
int v317;
HANDLE v318;
unsigned __int64 v319;
__int128 *v320;
int v321;
UINT64 a3;
BOOL v323;
__int128 v324;
__int64 v325;
int v326;
int v327;
int v328;
int v329;
int v330;
__int128 v331;
__int128 v332;
__int64 v333;
INT64 v334[2];
__m256i v335;
char v336[40];
__int64 v337;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
HANDLE v339;
HANDLE v340;
void **v341;
HANDLE v342;
int v343;
__int128 v344;
struct _KAPC_STATE ApcState;
__int128 P[2];
__int64 v347;
UINT8 v348[16];
__int128 v349;
__int128 v350;
__int128 v351;
__int128 v352;
__int128 v353;
__int128 v354;
__int128 v355;
__int128 v356;
UINT8 dst[160];
char pszDest[16];
__int128 v359;
__int128 v360;
__int128 v361;
char v362;
v4 = (unsigned int)ProcessInformationLength;
v5 = (__int64)ProcessInformation;
Alignment = ProcessInformationClass;
v295 = (__int64)ProcessInformation;
v274 = ProcessInformationLength;
v7 = 0;
v268 = 0i64;
GroupAffinity = 0i64;
LODWORD(CapturedSid) = 0;
v276 = 0;
Size = 0i64;
v309 = 0i64;
v319 = 0i64;
v287[0] = 0;
v344 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
a11 = (INT64)CurrentThread;
v9 = *((_BYTE *)CurrentThread + 562);
if( v9 )
{
switch( ProcessInformationClass )
{
case 5:
v10 = 4;
break;
case 17:
v10 = 1;
break;
case 25:
v10 = 1;
break;
case 18:
v10 = 1;
break;
case 21:
v10 = 8;
break;
case 33:
v10 = 4;
break;
case 39:
v10 = 4;
break;
case 35:
v10 = 8;
break;
case 8:
v10 = 8;
break;
case 40:
v10 = 8;
break;
case 41:
v10 = 8;
break;
case 98:
v10 = 8;
break;
case 99:
v10 = 8;
break;
case 45:
v10 = 4;
break;
case 46:
v10 = 4;
break;
case 49:
v10 = 8;
break;
case 53:
v10 = 8;
break;
case 56:
v10 = 8;
break;
case 62:
v10 = 8;
break;
case 65:
v10 = 8;
break;
case 70:
v10 = 1;
break;
case 74:
v10 = 1;
break;
case 83:
v10 = 8;
break;
case 90:
v10 = 1;
break;
case 91:
v10 = 4;
break;
case 93:
v10 = 4;
break;
case 95:
v10 = 8;
break;
case 87:
v10 = 1;
break;
case 100:
v10 = 1;
break;
case 101:
v10 = 8;
break;
default:
v10 = 4;
if( ProcessInformationClass == (ProcessCycleTime|0x40) )
v10 = 8;
break;
}
if( (_DWORD)ProcessInformationLength )
{
if( ((v10 - 1) & (unsigned int)ProcessInformation) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)ProcessInformation + (unsigned int)ProcessInformationLength > 0x7FFFFFFF0000i64
|| (char *)ProcessInformation + (unsigned int)ProcessInformationLength < ProcessInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
CurrentThread = (_ETHREAD *)a11;
}
}
switch( ProcessInformationClass )
{
case 1:
return PspSetQuotaLimits(ProcessHandle, ProcessInformation, (unsigned int)ProcessInformationLength, v9);
case 5:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v326 = *(_DWORD *)ProcessInformation;
v18 = v326;
if( v326 < 0 )
v18 = v326 & 0x7FFFFFFF;
v19 = v326 < 0 ? 2 : 0;
if( (unsigned int)(v18 - 1) > 0x1E )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v20 = (_EPROCESS *)v268;
if( v18 > *((char *)v268 + 640)
&& !SeCheckPrivilegedObject(*(_LUID *)SeIncreaseBasePriorityPrivilege, ProcessHandle, 0x200u, v9) )
{
ObfDereferenceObjectWithTag(v20, 0x79517350ui64);
return -1073741727;
}
Tag[0] = 0;
KeSetPriorityAndQuantumProcess((_KPROCESS *)v20, (unsigned int)v18, 0, 0i64, *(UINT64 *)Tag);
MmSetMemoryPriorityProcess(v20, v19);
ObfDereferenceObjectWithTag(v20, 0x79517350ui64);
return 0;
case 6:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v25 = *(_DWORD *)ProcessInformation;
v327 = *(_DWORD *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
v26 = result;
if( result >= 0 )
{
v27 = (struct _EX_RUNDOWN_REF *)v268;
if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)v268 + 139) )
{
for( i = PsGetNextProcessThread((__int64)v27, 0i64); i; i = PsGetNextProcessThread((__int64)v27, i) )
KeBoostPriorityThread((__int64)i, v25);
ExReleaseRundownProtection(v27 + 139);
ObfDereferenceObjectWithTag(v27, 0x79517350ui64);
return v26;
}
else
{
ObfDereferenceObjectWithTag(v27, 0x79517350ui64);
return -1073741558;
}
}
return result;
case 8:
if( (_DWORD)ProcessInformationLength == 8 )
{
v30 = 0;
v297 = 0;
Handle = *(HANDLE *)ProcessInformation;
v318 = Handle;
}
else
{
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
Handle = *(HANDLE *)ProcessInformation;
v318 = Handle;
v297 = *((_DWORD *)ProcessInformation + 2);
v30 = v297;
if( (v297 & 0xFFFFFFF8) != 0 )
return -1073741811;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
v293 = 0i64;
result = ObReferenceObjectByHandle(Handle, 0, LpcPortObjectType, v9, &v293, 0i64);
DmaAdapter = (PADAPTER_OBJECT)v293;
if( result >= 0 )
{
v31 = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x800u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( v31 < 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v293);
return v31;
}
v32 = (struct _EX_RUNDOWN_REF *)((unsigned __int64)v293 | v30);
RunRef = v32;
v33 = (signed __int64 *)((char *)v268 + 1200);
_m_prefetchw((char *)v268 + 1200);
v34 = *v33;
while( 1 )
{
Handle = (HANDLE)v34;
if( (_DWORD)v4 == 16 )
{
*(_DWORD *)(v5 + 8) = v34 & 7;
}
else if( (v34 & 7) != 0 )
{
HalPutDmaAdapter(DmaAdapter);
LABEL_133:
v13 = -1073741811;
goto LABEL_142;
}
v35 = _InterlockedCompareExchange64((volatile signed __int64 *)v268 + 150, (signed __int64)v32, v34);
v166 = v34 == v35;
v34 = v35;
if( v166 )
{
if( v35 )
{
memset(&v336[8], 0, 32);
v36 = (struct _DMA_ADAPTER *)(v35 & 0xFFFFFFFFFFFFFFF8ui64);
*(_QWORD *)v336 = 0xD00300008i64;
v337 = *((_QWORD *)v268 + 136);
while( 1 )
{
v37 = LpcRequestPort((INT64)v36, (__m256i *)v336);
if( v37 != -1073741801 && v37 != -1073741670 )
break;
KeDelayExecutionThread(0, 0, (PLARGE_INTEGER)&PspShortTime);
}
PspLockUnlockProcessExclusive((__int64)v268, a11);
HalPutDmaAdapter(v36);
}
v13 = 0;
goto LABEL_142;
}
}
}
return result;
case 9:
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
PspAssignPrimaryToken(
CurrentThread,
v9,
(UINT8)ProcessHandle,
*(PVOID **)ProcessInformation,
*(INT64 *)Tag,
(INT64)Object,
(INT64)HandleInformation,
v267,
(INT64)v268,
v269,
a11,
v271,
v272,
CapturedSid);
return result;
case 10:
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x220u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result >= 0 )
goto LABEL_150;
return result;
case 11:
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x220u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result >= 0 )
goto LABEL_150;
return result;
case 12:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v29 = *(_DWORD *)ProcessInformation;
v321 = *(_DWORD *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
PspSetProcessDefaultHardErrorMode((__int64)v268, a11, v29);
goto LABEL_89;
case 13:
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result >= 0 )
{
LABEL_150:
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return xKdEnumerateDebuggingDevices(v39, v38, v40);
}
return result;
case 15:
case 42:
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v12 = (volatile signed __int64 *)v268;
v13 = PsChargeProcessNonPagedPoolQuota((__int64)v268, 0x6028ui64);
if( v13 < 0 )
goto LABEL_80;
PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x6028ui64, 0x73577350ui64);
if( PoolWithTag )
{
PsWatchEnabled = 1;
*(_DWORD *)PoolWithTag = 0;
*((_QWORD *)PoolWithTag + 1) = 0i64;
KeInitializeGate((_KGATE *)(PoolWithTag + 16), v15);
if( !_InterlockedCompareExchange64(v12 + 166, (signed __int64)v16, 0i64) )
{
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return 0;
}
ExFreePoolWithTag(v16, 0);
v13 = -1073741752;
v12 = (volatile signed __int64 *)v268;
}
else
{
v13 = -1073741801;
}
PsReturnProcessNonPagedPoolQuota((ULONG_PTR)v12, 0x6028ui64);
LABEL_80:
ObfDereferenceObjectWithTag((PVOID)v12, 0x79517350ui64);
return v13;
case 16:
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return -1073741822;
case 17:
if( (_DWORD)ProcessInformationLength != 1 )
return -1073741820;
v41 = *(_BYTE *)ProcessInformation;
v280 = *(_BYTE *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result >= 0 )
{
v42 = a11;
v43 = v268;
PspLockProcessExclusive((__int64)v268, a11);
if( v41 )
v43[382] |= 4u;
else
v43[382] &= ~4u;
v44 = *((_QWORD *)v43 + 176);
if( v44 )
{
v45 = *(_WORD *)(v44 + 8);
if( v45 == 332 || v45 == 452 )
v41 = 1;
}
KeSetAutoAlignmentProcess((__int64)v43, v41);
PspUnlockProcessExclusive(v46, v42);
ObfDereferenceObjectWithTag(v43, 0x79517350ui64);
return 0;
}
return result;
case 18:
if( (_DWORD)ProcessInformationLength != 2 )
return -1073741820;
v21 = *(_WORD *)ProcessInformation;
v276 = *(_WORD *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result >= 0 )
{
v22 = v268;
v23 = PspSetProcessPriorityClass((__int64)v268, HIBYTE(v276), (unsigned __int64)ProcessHandle, v9);
if( v23 >= 0 )
{
LOBYTE(v7) = (_BYTE)v21 != 0;
PsSetProcessPriorityByClass((INT64)v22, v7);
}
ObfDereferenceObjectWithTag(v22, 0x79517350ui64);
return v23;
}
return result;
case 19:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v47 = *(_DWORD *)ProcessInformation;
v328 = *(_DWORD *)ProcessInformation;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
v13 = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( v13 < 0 )
return v13;
if( *((_QWORD *)v268 + 280) )
{
LABEL_169:
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return -1073741790;
}
else
{
if( v47 )
_InterlockedOr((volatile signed __int32 *)v268 + 281, 0x1000000u);
else
_InterlockedAnd((volatile signed __int32 *)v268 + 281, 0xFEFFFFFF);
LABEL_142:
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return v13;
}
case 21:
if( (_DWORD)ProcessInformationLength == 8 )
{
GroupAffinity.Mask = *(_QWORD *)ProcessInformation;
if( !GroupAffinity.Mask )
return -1073741811;
}
else
{
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
GroupAffinity = *(GROUP_AFFINITY *)ProcessInformation;
if( !KeVerifyGroupAffinity(&GroupAffinity, 0) )
return -1073741811;
}
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v48 = v268;
KeQueryGroupMaskProcess((_EPROCESS *)v268);
if( (((_DWORD)v49 - 1) & (unsigned int)v49) != 0 )
goto LABEL_180;
if( (_DWORD)v4 == 8 )
{
_BitScanForward((unsigned int *)&v49, v49);
LODWORD(CapturedSid) = v49;
v50 = GroupAffinity.Mask & KeActiveProcessors.Bitmap[v49];
v48 = v268;
if( v50 != GroupAffinity.Mask )
{
LABEL_180:
ObfDereferenceObjectWithTag(v48, 0x79517350ui64);
return -1073741811;
}
GroupAffinity.Group = (unsigned __int16)CapturedSid;
GroupAffinity.Mask = v50;
}
v51 = a11;
KeEnterCriticalRegionThread((_KTHREAD *)a11);
if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)v48 + 139) )
{
PspLockProcessSharedUnsafe((__int64)v48);
v52 = PspSetProcessAffinitySafe((__int64)v48, 0, 0i64, (__int64 *)&GroupAffinity, v287);
PspUnlockProcessSharedUnsafe((__int64)v48);
ExReleaseRundownProtection((PEX_RUNDOWN_REF)v48 + 139);
if( v52 >= 0 )
{
if( v287[0] )
PspWritePebAffinityInfo(v51, (struct _EX_RUNDOWN_REF *)v48);
_InterlockedOr((volatile signed __int32 *)v48 + 280, 0x200000u);
v53 = v268;
KeLeaveCriticalRegionThread(v51);
ObfDereferenceObjectWithTag(v53, 0x79517350ui64);
return v52;
}
}
else
{
v52 = -1073741558;
}
KeLeaveCriticalRegionThread(v51);
ObfDereferenceObjectWithTag(v48, 0x79517350ui64);
return v52;
case 22:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v329 = *(_DWORD *)ProcessInformation;
v54 = v329 != 0;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
v55 = result;
if( result < 0 )
return result;
v56 = (struct _EX_RUNDOWN_REF *)v268;
if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)v268 + 139) )
goto LABEL_194;
v57 = a11;
PspLockProcessExclusive((__int64)v56, a11);
KeSetDisableBoostProcess((__int64)v56, v54);
Count = (struct _EX_RUNDOWN_REF *)v56[188].Count;
if( Count != &v56[188] )
{
do
{
KeSetDisableBoostThread((__int64)&Count[-157], v54);
Count = (struct _EX_RUNDOWN_REF *)*v59;
}
while( Count != v60 );
}
PspUnlockProcessExclusive((__int64)v56, v57);
ExReleaseRundownProtection(v56 + 139);
ObfDereferenceObjectWithTag(v56, 0x79517350ui64);
return v55;
case 23:
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
v62 = *(HANDLE *)ProcessInformation;
v340 = *(HANDLE *)ProcessInformation;
if( (unsigned __int8)RtlIsSandboxedToken(0i64, v9) )
return -1073741790;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v63 = ObSetProcessDeviceMap((__int64)v268, v62, v9);
LABEL_209:
v64 = v63;
v65 = v268;
goto LABEL_210;
case 24:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v66 = *(_DWORD *)ProcessInformation;
v330 = *(_DWORD *)ProcessInformation;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x204u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
if( v66 != (unsigned int)MmGetSessionId((__int64)v268) )
v7 = -1073741790;
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return v7;
case 25:
if( (_DWORD)ProcessInformationLength != 1 )
return -1073741820;
v24 = *(_BYTE *)ProcessInformation;
v279 = *(_BYTE *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
LOBYTE(v7) = v24 != 0;
PsSetProcessPriorityByClass((INT64)v268, v7);
goto LABEL_89;
case 29:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v67 = *(_DWORD *)ProcessInformation;
v311 = *(_DWORD *)ProcessInformation;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) )
return -1073741727;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
if( v67 )
_InterlockedOr((volatile signed __int32 *)v268 + 281, 0x2000u);
else
_InterlockedAnd((volatile signed __int32 *)v268 + 281, 0xFFFFDFFF);
goto LABEL_89;
case 31:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
v13 = result;
if( result < 0 )
return result;
v61 = *(_DWORD *)v5;
v298 = *(_DWORD *)v5;
if( v13 < 0 )
goto LABEL_142;
if( (v61 & 0xFFFFFFFE) != 0 )
goto LABEL_133;
if( (v61 & 1) != 0 )
_InterlockedAnd((volatile signed __int32 *)v268 + 281, 0xFFFFFFFD);
else
_InterlockedOr((volatile signed __int32 *)v268 + 281, 2u);
goto LABEL_142;
case 32:
v294 = 0i64;
if( !(_DWORD)ProcessInformationLength )
goto LABEL_231;
if( (((_DWORD)ProcessInformationLength - 4) & 0xFFFFFFFB) != 0 )
return -1073741820;
v68 = *(_DWORD *)ProcessInformation;
LODWORD(v294) = *(_DWORD *)ProcessInformation;
if( (_DWORD)ProcessInformationLength == 8 )
HIDWORD(v294) = *((_DWORD *)ProcessInformation + 1);
else
HIDWORD(v294) = 0;
if( v68 )
return -1073741811;
LABEL_231:
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v166 = (_DWORD)v4 == 0;
v69 = v268;
if( v166 )
v70 = 0i64;
else
v70 = (_PROCESS_HANDLE_TRACING_ENABLE_EX *)&v294;
v71 = PsSetProcessHandleTracingInformation((_EPROCESS *)v268, v70);
goto LABEL_236;
case 33:
if( (((_DWORD)ProcessInformationLength - 4) & 0xFFFFFFFB) != 0 )
return -1073741820;
if( (_DWORD)ProcessInformationLength == 4 )
{
v73 = *(_DWORD *)ProcessInformation;
v283 = *(_DWORD *)ProcessInformation;
LOBYTE(v74) = 0;
}
else
{
v319 = *(_QWORD *)ProcessInformation;
v73 = v319;
v74 = HIDWORD(v319);
v283 = v319;
}
if( v73 >= 4 )
return -1073741811;
if( v73 >= 3 && !SeCheckPrivilegedObject(*(_LUID *)SeIncreaseBasePriorityPrivilege, ProcessHandle, 0x200u, v9) )
return -1073741727;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
v75 = result;
if( result < 0 )
return result;
v76 = (volatile signed __int32 *)v268;
RunRef = (PEX_RUNDOWN_REF)((char *)v268 + 1112);
if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)v268 + 139) )
{
v77 = a11;
PspLockProcessExclusive((__int64)v76, a11);
v78 = *((_DWORD *)v76 + 281);
v79 = v283 << 27;
do
{
v80 = v78;
v78 = _InterlockedCompareExchange(v76 + 281, v79 | v78 & 0xC7FFFFFF, v78);
}
while( v78 != v80 );
v81 = (char *)v268;
v82 = (KSPIN_LOCK *)*((_QWORD *)v268 + 188);
if( v82 != (KSPIN_LOCK *)((char *)v268 + 1504) )
{
v83 = v283;
do
{
if( (_BYTE)v74 == 1 && ((*((_DWORD *)v82 + 10) >> 9) & 7) < v83 )
IoBoostThreadIoPriority(v82 - 157, v83, 0);
PsSetIoPriorityThread((__int64)(v82 - 157), v83);
v82 = (KSPIN_LOCK *)*v82;
}
while( v82 != (KSPIN_LOCK *)(v81 + 1504) );
}
PspUnlockProcessExclusive((__int64)v81, v77);
ExReleaseRundownProtection(RunRef);
ObfDereferenceObjectWithTag(v81, 0x79517350ui64);
return v75;
}
else
{
LABEL_247:
ObfDereferenceObjectWithTag((PVOID)v76, 0x79517350ui64);
return -1073741558;
}
case 34:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
v84 = *(_DWORD *)ProcessInformation;
CurrentProcess = (_EPROCESS *)PsGetCurrentProcess();
KeSetExecuteOptions(CurrentProcess, v84);
v72 = v86;
if( v86 < 0 || (v84 & 3) != 1 )
return v72;
MmRemoveExecuteGrants();
return v72;
case 35:
memset(P, 0, sizeof(P));
v347 = 0i64;
LODWORD(v269) = 0;
v284 = 0i64;
v289 = 0i64;
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
if( v9 != 1 )
return -1073741823;
if( (unsigned int)ProcessInformationLength < 0x28 )
return -1073741820;
v98 = (unsigned int)(ProcessInformationLength - 16) / 0x18ui64;
if( (unsigned int)(ProcessInformationLength - 16) % 0x18ui64 )
return -1073741820;
if( (_DWORD)ProcessInformationLength == 40 )
{
PoolWithQuotaTag = P;
a11 = (INT64)P;
}
else
{
PoolWithQuotaTag = (__int128 *)ExAllocatePoolWithQuotaTag(
(POOL_TYPE)9,
(unsigned int)ProcessInformationLength,
0x736C5450ui64);
a11 = (INT64)PoolWithQuotaTag;
if( !PoolWithQuotaTag )
return -1073741670;
}
v320 = PoolWithQuotaTag;
RunRef = (PEX_RUNDOWN_REF)PoolWithQuotaTag;
memmove((UINT8 *)PoolWithQuotaTag, (UINT8 *)v5, v4);
if( *((_DWORD *)PoolWithQuotaTag + 1) < 2u
&& (v100 = *(_DWORD *)PoolWithQuotaTag, (*(_DWORD *)PoolWithQuotaTag & 0xFFFFFFFE) == 0)
&& (v101 = *((unsigned int *)PoolWithQuotaTag + 2), (_DWORD)v101)
&& v98 == v101 )
{
v102 = 0;
LODWORD(v269) = 0;
v103 = PoolWithQuotaTag + 1;
do
{
if( *v103 )
goto LABEL_331;
LODWORD(v269) = ++v102;
v103 += 6;
}
while( v102 < (unsigned int)v101 );
v104 = (_QWORD *)PsGetCurrentProcess();
v268 = v104;
v274 = 0;
if( (v100 & 1) != 0 )
{
v105 = v104[176];
if( !v105 || (v106 = *(_WORD *)(v105 + 8), v106 != 332) && v106 != 452 )
{
LABEL_331:
v13 = -1073741811;
goto LABEL_333;
}
v274 = 1;
}
v107 = v274 ^ 1u;
Alignment = 4 * v107 + 4;
v295 = 4 * v107 + 4;
v285 = v5;
v269 = 0i64;
v13 = 0;
for( j = 0i64; ; j = Handle )
{
Handle = PsGetNextProcessThread((__int64)v268, j);
v109 = Handle;
if( !Handle || (unsigned int)v269 >= *((_DWORD *)PoolWithQuotaTag + 2) )
break;
if( (*((_DWORD *)Handle + 29) & 0x400) == 0 && ExAcquireRundownProtection((PEX_RUNDOWN_REF)Handle + 159) )
{
v110 = v109[30];
v307 = v110;
if( v274 )
{
v111 = (UINT8 *)(v110 + 8236);
v289 = v110 + 8236;
v112 = (UINT8 *)PtrToUlong((PVOID)*(unsigned int *)(v110 + 8236));
}
else
{
v111 = (UINT8 *)(v110 + 88);
v289 = v110 + 88;
v112 = *(UINT8 **)(v110 + 88);
}
v284 = v112;
if( v112 )
{
if( *((_DWORD *)PoolWithQuotaTag + 1) == 1 )
{
if( v112 == v111 )
{
v284 = 0i64;
}
else
{
v113 = *((unsigned int *)PoolWithQuotaTag + 3);
v114 = v295 * v113;
if( v295 * v113 )
{
if( ((Alignment - 1) & (unsigned int)v112) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v112[v114] > 0x7FFFFFFF0000i64 || &v112[v114] < v112 )
{
MEMORY[0x7FFFFFFF0000] = 0;
v113 = *((unsigned int *)v320 + 3);
}
}
v115 = (VOID **)PoolWithQuotaTag + 3 * (unsigned int)v269 + 3;
ProbeForWrite(*v115, v295 * v113, Alignment);
memmove((UINT8 *)*v115, v112, v295 * *((unsigned int *)PoolWithQuotaTag + 3));
_InterlockedOr(v263, 0);
v110 = v307;
}
v116 = (unsigned int)v269;
*(_DWORD *)(v285 + 24i64 * (unsigned int)v269 + 16) |= 1u;
Ptr = RunRef[3 * v116 + 3].Ptr;
if( v274 )
*(_DWORD *)(v110 + 8236) = PtrToUlong(Ptr);
else
*(_QWORD *)(v110 + 88) = Ptr;
v118 = v285 + 24i64 * (unsigned int)v269;
*(_QWORD *)(v118 + 32) = *((_QWORD *)Handle + 144);
*(_QWORD *)(v118 + 24) = v284;
*(_DWORD *)(v118 + 16) ^= 3u;
LODWORD(v269) = (_DWORD)v269 + 1;
}
else
{
v119 = 24i64 * (unsigned int)v269;
*(_DWORD *)(v119 + v285 + 16) |= 1u;
Ptr_high = HIDWORD(RunRef[1].Ptr);
if( v274 )
{
v121 = (unsigned __int64)&v112[4 * Ptr_high];
if( v121 >= 0x7FFFFFFF0000i64 )
v121 = 0x7FFFFFFF0000i64;
v122 = PtrToUlong((PVOID)*(unsigned int *)v121);
v289 = v122;
v123 = PtrToUlong(*(PVOID *)((char *)PoolWithQuotaTag + v119 + 24));
v124 = (unsigned __int64)&v284[4 * *((unsigned int *)PoolWithQuotaTag + 3)];
if( v124 >= 0x7FFFFFFF0000i64 )
v124 = 0x7FFFFFFF0000i64;
*(_DWORD *)v124 = v123;
}
else
{
v125 = (unsigned __int64)&v112[8 * Ptr_high];
if( v125 >= 0x7FFFFFFF0000i64 )
v125 = 0x7FFFFFFF0000i64;
v122 = *(_QWORD *)v125;
v289 = *(_QWORD *)v125;
v126 = (unsigned __int64)&v284[8 * *((unsigned int *)PoolWithQuotaTag + 3)];
if( v126 >= 0x7FFFFFFF0000i64 )
v126 = 0x7FFFFFFF0000i64;
*(_QWORD *)v126 = *(_QWORD *)((char *)PoolWithQuotaTag + v119 + 24);
}
v127 = 3i64 * (unsigned int)v269;
v128 = v285;
*(_QWORD *)(v285 + 8 * v127 + 24) = v122;
*(_DWORD *)(v128 + 8 * v127 + 16) ^= 3u;
LODWORD(v269) = (_DWORD)v269 + 1;
}
}
ExReleaseRundownProtection((PEX_RUNDOWN_REF)Handle + 159);
}
}
if( Handle )
PsQuitNextProcessThread(Handle);
}
else
{
v13 = -1073741820;
}
LABEL_333:
if( PoolWithQuotaTag == P )
return v13;
ExFreePoolWithTag(PoolWithQuotaTag, 0);
return v13;
case 39:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v299 = *(_DWORD *)ProcessInformation;
v87 = v299;
if( v299 > (unsigned int)MmGetDefaultPagePriority() || v299 < (unsigned int)MiCreateSystemWsles() )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
v88 = result;
if( result < 0 )
return result;
v76 = (volatile signed __int32 *)v268;
v89 = (struct _EX_RUNDOWN_REF *)((char *)v268 + 1112);
if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)v268 + 139) )
goto LABEL_247;
v90 = a11;
PspLockProcessExclusive((__int64)v76, a11);
v91 = v87 << 12;
v92 = *((_DWORD *)v76 + 280);
do
{
v93 = v92;
v92 = _InterlockedCompareExchange(v76 + 280, v91 | v92 & 0xFFFF8FFF, v92);
}
while( v92 != v93 );
v94 = v268;
v95 = (char *)v268 + 1504;
v96 = (char *)*((_QWORD *)v268 + 188);
if( v96 != (char *)v268 + 1504 )
{
v97 = v299;
do
{
PsSetPagePriorityThread((__int64)(v96 - 1256), v97);
v96 = *(char **)v96;
}
while( v96 != v95 );
}
PspUnlockProcessExclusive((__int64)v94, v90);
ExReleaseRundownProtection(v89);
ObfDereferenceObjectWithTag(v94, 0x79517350ui64);
return v88;
case 40:
memset(&ApcState, 0, sizeof(ApcState));
if( (((_DWORD)ProcessInformationLength - 8) & 0xFFFFFFF7) != 0 )
return -1073741820;
if( (_DWORD)ProcessInformationLength == 8 )
{
*(_QWORD *)&v296 = 0i64;
v129 = *(_QWORD *)ProcessInformation;
*((_QWORD *)&v296 + 1) = *(_QWORD *)ProcessInformation;
}
else
{
v296 = *(_OWORD *)ProcessInformation;
v129 = *((_QWORD *)&v296 + 1);
}
if( DWORD1(v296) )
return -1073741811;
if( (_DWORD)v296 != DWORD1(v296) )
return -1073741736;
if( v129 != (__int64)(v129 << 16) >> 16 )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v130 = (_QWORD *)PsGetCurrentProcess();
v131 = SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9);
v56 = (struct _EX_RUNDOWN_REF *)v268;
if( !v131 && v268 != v130 )
{
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return -1073741727;
}
if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)v268 + 139) )
{
LABEL_194:
ObfDereferenceObjectWithTag(v56, 0x79517350ui64);
return -1073741558;
}
v132 = v56[176].Count;
v134 = 0;
if( v132 )
{
v133 = *(_WORD *)(v132 + 8);
if( v133 == 332 || v133 == 452 )
v134 = 1;
}
v135 = v130[176];
if( v134 )
{
if( v135 )
{
v139 = *(_WORD *)(v135 + 8);
if( v139 == 332 || v139 == 452 )
{
KeStackAttachProcess((PRKPROCESS)v56, &ApcState);
if( v129 < (unsigned __int64)MmGetMaximumUserAddress()
&& (unsigned int)MmValidateUserCallTarget((PVOID)v129, 1ui64) )
{
v140 = 0i64;
v141 = (__int64 *)v56[176].Count;
if( v141 )
v140 = *v141;
*(_DWORD *)(v140 + 1160) = DWORD2(v296);
KeUnstackDetachProcess(&ApcState);
}
else
{
v7 = -1073741811;
KeUnstackDetachProcess(&ApcState);
}
LABEL_378:
ExReleaseRundownProtection(v56 + 139);
LABEL_379:
ObfDereferenceObjectWithTag(v56, 0x79517350ui64);
return v7;
}
}
}
else if( !v135 || (v136 = *(_WORD *)(v135 + 8), v136 != 332) && v136 != 452 )
{
KeStackAttachProcess((PRKPROCESS)v56, &ApcState);
if( !(unsigned int)MmValidateUserCallTarget((PVOID)v129, 0i64) )
v7 = -1073741811;
KeUnstackDetachProcess(&ApcState);
if( (v7 & 0x80000000) == 0 )
{
v137 = a11;
PspLockProcessExclusive((__int64)v56, a11);
v56[123].Count = v129;
v138 = (volatile signed __int32 *)v56[188].Count;
if( v138 != (volatile signed __int32 *)&v56[188] )
{
while( 1 )
{
if( v129 )
_interlockedbittestandset(v138 - 314, 0x19u);
else
_interlockedbittestandreset(v138 - 314, 0x19u);
v138 = *(volatile signed __int32 **)v138;
if( v138 == (volatile signed __int32 *)&v56[188] )
break;
v129 = *((_QWORD *)&v296 + 1);
}
v56 = (struct _EX_RUNDOWN_REF *)v268;
}
PspUnlockProcessExclusive((__int64)v56, v137);
}
goto LABEL_378;
}
v7 = -1073741637;
goto LABEL_378;
case 41:
v331 = 0i64;
v332 = 0i64;
v333 = 0i64;
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
v142 = 0i64;
if( (_DWORD)ProcessInformationLength == 40 )
{
if( v9 )
{
v331 = *(_OWORD *)ProcessInformation;
v332 = *((_OWORD *)ProcessInformation + 1);
v333 = *((_QWORD *)ProcessInformation + 4);
v142 = (char *)ProcessInformation + 32;
v5 = (__int64)&v331;
}
v143 = *(unsigned int *)v5;
if( (unsigned int)v143 > 0x40 || *(_DWORD *)(v5 + 4) | *(_DWORD *)(v5 + 8) | *(_DWORD *)(v5 + 12) )
return -1073741811;
v5 += 16i64;
}
else
{
if( (_DWORD)ProcessInformationLength != 24 )
return -1073741820;
v143 = 0i64;
if( v9 )
{
v332 = *(_OWORD *)ProcessInformation;
v142 = (char *)ProcessInformation + 16;
v5 = (__int64)&v332;
}
}
if( !*(_QWORD *)v5 )
return -1073741811;
a3 = *(_QWORD *)v5;
*(_QWORD *)(v5 + 16) = 0i64;
Tag[0] = 0;
result = MmAllocateUserStack((INT64 *)(v5 + 16), *(_QWORD *)(v5 + 8), &a3, v143, *(INT64 *)Tag);
if( result >= 0 && v9 )
*(_QWORD *)v142 = *(_QWORD *)(v5 + 16);
return result;
case 45:
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
*(_DWORD *)v300 = *(_DWORD *)ProcessInformation;
if( (*(_DWORD *)v300 & 0xFFFFFFFC) != 0 )
return -1073741811;
return PspSetProcessAffinityUpdateMode((INT64)CurrentThread, (INT64 *)v300);
case 46:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v312 = *(_DWORD *)ProcessInformation;
v144 = v312;
if( (v312 & 0xFFFFFFFE) != 0 )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
if( (v144 & 1) != 0 )
_InterlockedOr((volatile signed __int32 *)v268 + 281, 0x200000u);
else
_InterlockedAnd((volatile signed __int32 *)v268 + 281, 0xFFDFFFFF);
goto LABEL_89;
case 48:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v145 = *(_DWORD *)ProcessInformation;
v313 = *(_DWORD *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v146 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v268);
SeSetVirtualizationToken(v146, v145);
HalPutDmaAdapter(v146);
goto LABEL_89;
case 49:
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
if( ProcessHandle != (PVOID)-1i64 || (*(_QWORD *)ProcessInformation & 3) != 1 )
return -1073741811;
v147 = *(HANDLE *)ProcessInformation;
*(_QWORD *)(PsGetCurrentProcess() + 1352) = v147;
return 0;
case 52:
LOBYTE(v271) = 0;
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
v272 = *(_QWORD *)ProcessInformation;
if( ProcessHandle != (PVOID)-1i64 && (_DWORD)v272 != 2 )
return -1073741811;
break;
case 53:
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
*(_OWORD *)v334 = *(_OWORD *)ProcessInformation;
if( LOBYTE(v334[1]) )
return RtlRemoveDynamicFunctionTable(v334[0]);
else
return RtlInsertDynamicFunctionTable(v334[0]);
case 54:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v314 = *(_DWORD *)ProcessInformation;
v207 = v314;
if( (v314 & 0xFFFFFFFE) != 0 )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result >= 0 )
{
v208 = (struct _EX_RUNDOWN_REF *)v268;
v209 = (_HANDLE_TABLE *)ObReferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)v268);
if( v209 )
{
ExEnableHandleExceptions(v209, v207 & 1);
ObDereferenceProcessHandleTable(v208);
}
else
{
v7 = -1073741558;
}
ObfDereferenceObjectWithTag(v208, 0x79517350ui64);
return v7;
}
return result;
case 56:
*(_OWORD *)Src = 0i64;
v210 = 0i64;
v306 = 0i64;
if( v9 != 1 )
goto LABEL_782;
if( (unsigned __int64)ProcessInformation >= 0x7FFFFFFF0000i64 )
v5 = 0x7FFFFFFF0000i64;
v211 = *(_DWORD *)v5;
LODWORD(Src[0]) = v211;
v212 = *(void **)(v5 + 8);
Src[1] = v212;
if( !(_WORD)v211 )
return -1073741811;
if( ((unsigned __int8)v212 & 1) != 0 )
ExRaiseDatatypeMisalignment();
v213 = (unsigned __int64)v212 + (unsigned __int16)v211;
if( v213 > 0x7FFFFFFF0000i64 || v213 < (unsigned __int64)v212 )
MEMORY[0x7FFFFFFF0000] = 0;
v214 = ExAllocatePoolWithTag(NonPagedPoolNx, LOWORD(Src[0]), 0x6E497350ui64);
v210 = v214;
v306 = v214;
if( !v214 )
return -1073741670;
memmove((UINT8 *)v214, (UINT8 *)Src[1], LOWORD(Src[0]));
Src[1] = v210;
v5 = (__int64)Src;
v341 = Src;
LABEL_782:
v13 = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( v13 >= 0 )
{
v215 = v268;
v216 = IoRevokeHandlesForProcess((_UNICODE_STRING *)v5, (_EPROCESS *)v268);
if( v210 )
ExFreePoolWithTag(v210, 0);
ObfDereferenceObjectWithTag(v215, 0x79517350ui64);
return v216;
}
else
{
if( !v210 )
return v13;
ExFreePoolWithTag(v210, 0);
return v13;
}
case 57:
return MmProcessWorkingSetControl(ProcessHandle, ProcessInformation, (unsigned int)ProcessInformationLength, v9);
case 59:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v217 = *(_DWORD *)v5 != 0;
v323 = *(_DWORD *)v5 != 0;
v218 = (PVOID)PsGetCurrentProcess();
v149 = (__int64)v268;
if( v218 == v268 )
goto LABEL_169;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) )
{
ObfDereferenceObjectWithTag((PVOID)v149, 0x79517350ui64);
return -1073741727;
}
v13 = 0;
KeSetCheckStackExtentsProcess(v149, v217);
if( !v217 && (*(_DWORD *)(v149 + 1120) & 0x20000) != 0 )
{
_InterlockedAnd((volatile signed __int32 *)(v149 + 1120), 0xFFFDFFFF);
v149 = (__int64)v268;
}
goto LABEL_757;
case 62:
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
v344 = *(_OWORD *)ProcessInformation;
if( (_WORD)v344 != 1 || DWORD1(v344) )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
if( *((_QWORD *)&v344 + 1) )
_InterlockedOr((volatile signed __int32 *)v268 + 281, 0x100u);
else
_InterlockedAnd((volatile signed __int32 *)v268 + 281, 0xFFFFFEFF);
goto LABEL_89;
case 63:
v308 = 0i64;
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v308 = *(_QWORD *)v5;
v63 = PsSetProcessFaultInformation((INT64)v268, &v308);
goto LABEL_209;
case 65:
if( (_DWORD)ProcessInformationLength != 32 )
return -1073741820;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2001u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v335 = *(__m256i *)v5;
if( v335.m256i_i32[0] != 3 )
{
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return -1073741735;
}
if( (v335.m256i_i32[1] & 0xFFFFFFF8) != 0
|| *(_OWORD *)&v335.m256i_u64[1] != 0i64
|| ((((unsigned __int32)v335.m256i_i32[1] >> 1) & 1) != 0 || (v335.m256i_i8[4] & 4) != 0)
&& (v335.m256i_i8[4] & 1) == 0 )
{
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return -1073741811;
}
if( (((unsigned __int32)v335.m256i_i32[1] >> 1) & 1) != 0 || (v335.m256i_i8[4] & 4) != 0 )
{
v69 = v268;
MmReleaseCommitForMemResetPages((_EPROCESS *)v268, ((unsigned __int32)v335.m256i_i32[1] >> 2) & 1);
}
else
{
v69 = v268;
v71 = MmSetCommitReleaseEligibility((_EPROCESS *)v268, v335.m256i_i8[4] & 1);
}
LABEL_236:
v72 = v71;
ObfDereferenceObjectWithTag(v69, 0x79517350ui64);
return v72;
case 66:
case 67:
if( (ProcessInformationLength & 7) != 0 || (unsigned int)ProcessInformationLength > 0xA0 )
return -1073741820;
memmove(dst, (UINT8 *)ProcessInformation, (unsigned int)ProcessInformationLength);
v219 = (unsigned int)v4 >> 3;
v220 = Alignment;
if( Alignment == 67 )
{
result = ExCpuSetResourceManagerAccessCheck(v9);
if( result < 0 )
return result;
}
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
LOBYTE(v7) = v220 == 67;
v63 = KeSetCpuSetsProcess((_KPROCESS *)v268, v219, (UINT64 *)dst, v7);
goto LABEL_209;
case 68:
if( (*(_BYTE *)(PsGetCurrentProcess() + 1849) & 1) == 0 )
return -1073741727;
*(_QWORD *)&v300[4] = 0i64;
result = ObReferenceObjectByHandle(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
(PVOID *)&v300[4],
0i64);
v222 = result;
if( result >= 0 )
{
_InterlockedOr((volatile signed __int32 *)(*(_QWORD *)&v300[4] + 2172i64), 0x40u);
HalPutDmaAdapter(*(PADAPTER_OBJECT *)&v300[4]);
return v222;
}
return result;
case 70:
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
_InterlockedOr((volatile signed __int32 *)v268 + 280, 0x80000000);
goto LABEL_89;
case 71:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v223 = *(_DWORD *)ProcessInformation;
v316 = *(_DWORD *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v56 = (struct _EX_RUNDOWN_REF *)v268;
v224 = ObReferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)v268);
if( v224 )
{
ExEnableRaiseUMExceptionOnInvalidHandleClose(v224, v223);
ObDereferenceProcessHandleTable(v56);
}
else
{
v7 = -1073741558;
}
goto LABEL_379;
case 72:
return PsIumEnableOnDemandDebugWithResponse(
ProcessHandle,
ProcessInformation,
(unsigned int)ProcessInformationLength);
case 74:
if( (_DWORD)ProcessInformationLength != 1 )
return -1073741820;
v225 = *(_BYTE *)ProcessInformation;
v282 = *(_BYTE *)ProcessInformation;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
if( v225 )
_InterlockedOr((volatile signed __int32 *)v268 + 543, 0x200u);
else
_InterlockedAnd((volatile signed __int32 *)v268 + 543, 0xFFFFFDFF);
goto LABEL_89;
case 77:
v342 = 0i64;
v343 = 0;
if( (_DWORD)ProcessInformationLength != 12 )
return -1073741820;
v342 = *(HANDLE *)ProcessInformation;
v226 = *((_DWORD *)ProcessInformation + 2);
v343 = v226;
if( (_DWORD)v342 != 1 || (HIDWORD(v342) & 0xFFFFFFFC) != 0 || (~HIDWORD(v342) & v226) != 0 )
return -1073741811;
ExtensionTable = ExGetExtensionTable(PspBamExtensionHost);
if( !ExtensionTable )
return -1073741822;
v228 = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( v228 >= 0 )
{
v228 = (*(__int64(__fastcall **)(PVOID, HANDLE *))(ExtensionTable + 8))(v268, &v342);
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
}
ExReleaseExtensionTable(PspBamExtensionHost);
return v228;
case 80:
result = ExCpuSetResourceManagerAccessCheck(v9);
if( result < 0 )
return result;
if( (_DWORD)v4 != 1 )
return -1073741820;
v221 = *(_BYTE *)v5;
v281 = *(_BYTE *)v5;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
if( v221 )
_InterlockedOr((volatile signed __int32 *)v268 + 280, 0x8000000u);
else
_InterlockedAnd((volatile signed __int32 *)v268 + 280, 0xF7FFFFFF);
KeRecomputeCpuSetAffinityProcess((INT64)v268);
goto LABEL_89;
case 82:
if( (unsigned int)ProcessInformationLength < 8 )
return -1073741820;
*(_OWORD *)v348 = 0i64;
v349 = 0i64;
v350 = 0i64;
v351 = 0i64;
v352 = 0i64;
v353 = 0i64;
v354 = 0i64;
v355 = 0i64;
v356 = 0i64;
v229 = 144;
if( (unsigned int)ProcessInformationLength < 0x90 )
v229 = ProcessInformationLength;
memmove(v348, (UINT8 *)ProcessInformation, v229);
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v230 = v268;
v231 = PoSetProcessEnergyTrackingState(v268, v348);
v17 = v230;
if( v231 >= 0 )
goto LABEL_90;
ObfDereferenceObjectWithTag(v230, 0x79517350ui64);
return v231;
case 83:
return -1073741637;
case 85:
if( (_DWORD)ProcessInformationLength != 24 )
return -1073741820;
*(_OWORD *)pszDest = 0i64;
v359 = 0i64;
v360 = 0i64;
v361 = 0i64;
v362 = 0;
v232 = *(_OWORD *)ProcessInformation;
v324 = v232;
v325 = *((_QWORD *)ProcessInformation + 2);
if( (unsigned __int64)(v232 + 65) > 0x7FFFFFFF0000i64 || (__int64)v232 + 65 < (unsigned __int64)v232 )
MEMORY[0x7FFFFFFF0000] = 0;
RtlStringCbCopyA(pszDest, 0x41ui64, (PSTR)v232);
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x220u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
*(_QWORD *)&v324 = pszDest;
v362 = 0;
v13 = EtwSetProcessTelemetryCoverage((__int64)v268, (__int64)&v324);
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
*(_DWORD *)(v5 + 12) = HIDWORD(v324);
*(_DWORD *)(v5 + 16) = v325;
return v13;
case 87:
case 96:
if( ProcessInformationClass == (ProcessDeviceMap|0x40) && !(_DWORD)ProcessInformationLength
|| ProcessInformationClass == 96 && (unsigned int)ProcessInformationLength < 4 )
{
return -1073741820;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
{
return -1073741727;
}
v277 = 0;
if( Alignment == 87 )
v233 = (*(_BYTE *)v5 & 1 ^ *(_BYTE *)v5) & 2 ^ *(_BYTE *)v5 & 1;
else
v233 = *(_DWORD *)v5;
v277 = v233;
if( (v233 & 0xFFFFFFF0) != 0 )
return -1073741811;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v234 = (volatile signed __int32 *)v268;
_InterlockedAnd((volatile signed __int32 *)v268 + 543, 0xFFE7FFFF);
v235 = (((v277 >> 2) & 1) << 19) | 0x100000;
if( (v277 & 8) == 0 )
v235 = ((v277 >> 2) & 1) << 19;
_InterlockedOr(v234 + 543, v235);
v236 = (volatile signed __int32 *)v268;
_InterlockedAnd((volatile signed __int32 *)v268 + 280, 0xFCFFFFFF);
v237 = ((v277 & 1) << 24) | 0x2000000;
if( (v277 & 2) == 0 )
v237 = (v277 & 1) << 24;
_InterlockedOr(v236 + 280, v237);
goto LABEL_89;
case 90:
return SeCodeIntegritySetInformationProcess(
(__int64)ProcessHandle,
ProcessInformationClass,
ProcessInformation,
ProcessInformationLength);
case 91:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v317 = *(_DWORD *)ProcessInformation;
v238 = v317;
if( (v317 & 0xFFFFFFFE) != 0 )
return -1073741811;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v9) )
return -1073741727;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
PspSetProcessForegroundBackgroundRequest((INT64)v268, v238 & 1, 1);
LABEL_89:
v17 = v268;
LABEL_90:
ObfDereferenceObjectWithTag(v17, 0x79517350ui64);
return 0;
case 93:
if( (_DWORD)ProcessInformationLength != 4 )
return -1073741820;
v239 = *(_DWORD *)ProcessInformation;
v315 = *(_DWORD *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
v13 = result;
if( result < 0 )
return result;
v240 = (PVOID)PsGetCurrentProcess();
v149 = (__int64)v268;
if( v268 != v240 || !v239 )
{
v13 = -1073741811;
goto LABEL_757;
}
v241 = ExGetExtensionTable(PspBamExtensionHost);
if( !v241 )
goto LABEL_757;
(*(void(__fastcall **)(__int64, _QWORD))(v241 + 40))(v149, v239);
ExReleaseExtensionTable(PspBamExtensionHost);
ObfDereferenceObjectWithTag((PVOID)v149, 0x79517350ui64);
return v13;
case 95:
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
v242 = *(HANDLE *)ProcessInformation;
v339 = *(HANDLE *)ProcessInformation;
result = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x2000u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( result < 0 )
return result;
v64 = ObReferenceObjectByHandleWithTag(v242, 0x1000u, (POBJECT_TYPE)PsProcessType, v9, 0x79517350u, &v309, 0i64);
v65 = v268;
if( v64 < 0 )
{
LABEL_210:
ObfDereferenceObjectWithTag(v65, 0x79517350ui64);
return v64;
}
else
{
v243 = PspCombineSecurityDomains(v268, v309);
ObfDereferenceObjectWithTag(v309, 0x79517350ui64);
ObfDereferenceObjectWithTag(v268, 0x79517350ui64);
return v243;
}
case 97:
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
Size = *(_QWORD *)ProcessInformation;
if( (Size & 0xFFFFFFFE) != 0 || ProcessHandle != (PVOID)-1i64 )
return -1073741811;
v244 = PsGetCurrentProcess();
v245 = *(_QWORD *)(v244 + 1360);
if( !v245 )
return -1073741790;
v246 = 0i64;
v247 = *(__int64 **)(v244 + 1408);
if( v247 )
v246 = *v247;
v248 = Size & 1;
v249 = *(_DWORD *)(v245 + 1984);
if( (Size & 1) != 0 )
v250 = v249 | 1;
else
v250 = v249 & 0xFFFFFFFE;
*(_DWORD *)(v245 + 1984) = v250;
if( v246 )
{
v251 = *(_DWORD *)(v246 + 1140);
if( v248 )
v252 = v251 | 1;
else
v252 = v251 & 0xFFFFFFFE;
*(_DWORD *)(v246 + 1140) = v252;
}
return v7;
case 98:
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
if( v9 != 1 )
return -1073741823;
if( (_DWORD)ProcessInformationLength != 32 )
return -1073741820;
if( !KeIsUserCetAllowed() || (*((_DWORD *)KeGetCurrentThread() + 29) & 0x100000) == 0 )
return -1073741637;
return PspSetupUserFiberShadowStack(
*(_QWORD *)v5,
*(_QWORD *)(v5 + 8),
(unsigned int)*(_OWORD *)(v5 + 16),
(_QWORD *)(v5 + 24));
case 99:
if( ProcessHandle != (PVOID)-1i64 )
return -1073741811;
if( v9 != 1 )
return -1073741823;
if( (_DWORD)ProcessInformationLength != 8 )
return -1073741820;
if( KeIsUserCetAllowed() && (*((_DWORD *)KeGetCurrentThread() + 29) & 0x100000) != 0 )
return PspFreeUserFiberShadowStack(*(PVOID *)v5);
return -1073741637;
case 100:
if( (_DWORD)ProcessInformationLength != 1 )
return -1073741820;
if( !*(_BYTE *)ProcessInformation )
return -1073741811;
if( v9 )
return -1073741790;
v305 = 0i64;
result = ObReferenceObjectByHandle(ProcessHandle, 0xBEAu, (POBJECT_TYPE)PsProcessType, 0, &v305, 0i64);
if( result >= 0 )
{
v253 = PspEnableAltSystemCallHandling((INT64)v305);
HalPutDmaAdapter((PADAPTER_OBJECT)v305);
return v253;
}
return result;
case 101:
v254 = 0i64;
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
*(_OWORD *)Address = *(_OWORD *)ProcessInformation;
v255 = 16 * LOWORD(Address[0]);
if( !v255 )
return -1073741811;
v256 = (UINT8 *)Address[1];
if( !Address[1] )
return -1073741811;
Size = 16 * (unsigned int)LOWORD(Address[0]);
ProbeForWrite((VOID *)Address[1], v255, 8ui64);
if( WORD1(Address[0]) || HIDWORD(Address[0]) )
return -1073741811;
if( v9 != 1 )
return -1073741790;
BugCheckParameter1 = 0i64;
result = ObReferenceObjectByHandle(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
1,
&BugCheckParameter1,
0i64);
v257 = BugCheckParameter1;
v268 = BugCheckParameter1;
if( result < 0 )
return result;
if( v257 == (_DWORD *)PsGetCurrentProcess() && (v257[629] & 0x40000000) != 0 )
{
v13 = -1073741790;
}
else if( (v257[629] & 0x4000) != 0 )
{
Pool2 = ExAllocatePool2(257i64, Size, 0x4E484544ui64);
v254 = Pool2;
BugCheckParameter1 = Pool2;
if( Pool2 )
{
memmove((UINT8 *)Pool2, v256, Size);
v287[1] = 0;
v13 = PspProcessDynamicEHContinuationTargets(v257);
HIDWORD(v269) = v13;
LODWORD(CapturedSid) = 0;
}
else
{
v13 = -1073741801;
}
}
else
{
v13 = -1073741637;
}
goto LABEL_936;
case 102:
v254 = 0i64;
if( (_DWORD)ProcessInformationLength != 16 )
return -1073741820;
*(_OWORD *)v304 = *(_OWORD *)ProcessInformation;
v259 = 24 * LOWORD(v304[0]);
if( !v259 )
return -1073741811;
v260 = v304[1];
if( !v304[1] )
return -1073741811;
Size = v259;
ProbeForWrite(v304[1], v259, 8ui64);
if( WORD1(v304[0]) || HIDWORD(v304[0]) )
return -1073741811;
if( v9 != 1 )
return -1073741790;
v292 = 0i64;
result = ObReferenceObjectByHandle(ProcessHandle, 0x200u, (POBJECT_TYPE)PsProcessType, 1, &v292, 0i64);
v261 = (_EPROCESS *)v292;
v268 = v292;
if( result < 0 )
return result;
if( v261 == (_EPROCESS *)PsGetCurrentProcess() && (*((_DWORD *)v261 + 629) & 0x40000000) != 0 )
{
v13 = -1073741790;
}
else if( (*((_DWORD *)v261 + 629) & 0x4000) != 0 )
{
v262 = ExAllocatePool2(257i64, Size, 0x52414544ui64);
v254 = v262;
v292 = v262;
if( v262 )
{
memmove((UINT8 *)v262, v260, Size);
LODWORD(v288) = 0;
*(_QWORD *)Tag = &v288;
v13 = PspProcessDynamicEnforcedAddressRanges((PRKPROCESS)v261, (INT64)v261 + 2576);
HIDWORD(v269) = v13;
while( 1 )
{
LODWORD(CapturedSid) = v7;
if( v7 >= (unsigned int)v288 )
break;
*(_DWORD *)&v260[24 * v7 + 16] = v254[6 * v7 + 4];
++v7;
}
}
else
{
v13 = -1073741801;
}
}
else
{
v13 = -1073741637;
}
LABEL_936:
if( v268 )
HalPutDmaAdapter((PADAPTER_OBJECT)v268);
if( v254 )
{
ExFreePoolWithTag(v254, 0);
return v13;
}
return v13;
default:
return -1073741821;
}
v149 = PsGetCurrentProcess();
v268 = (PVOID)v149;
switch( (int)v272 )
{
case 1:
if( (v272 & 0xFFFFFFF000000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
v150 = (HIDWORD(v272) >> 1) & 1;
if( !v150 && (*(_DWORD *)(v149 + 2512) & 0x10) != 0 )
goto LABEL_437;
if( (v272 & 0x100000000i64) == 0 && (*(_DWORD *)(v149 + 2512) & 0x40) == 0 )
goto LABEL_437;
v151 = (HIDWORD(v272) >> 3) & 1;
if( !v151 && (*(_DWORD *)(v149 + 2512) & 8) != 0 )
goto LABEL_437;
if( v151 )
{
if( !v150 )
{
v13 = -1073741776;
goto LABEL_756;
}
}
else if( !v150 )
{
LABEL_443:
if( (v272 & 0x100000000i64) != 0 )
{
_InterlockedAnd((volatile signed __int32 *)(v149 + 2512), 0xFFFFFFBF);
v149 = (__int64)v268;
}
if( v151 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 8u);
v149 = (__int64)v268;
}
goto LABEL_447;
}
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 0x10u);
v149 = (__int64)v268;
goto LABEL_443;
case 2:
v156 = HIDWORD(v272);
if( (v272 & 0xFFFFFFF000000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) != 0 && (v272 & 0x800000000i64) != 0 )
v156 = HIDWORD(v272) & 0xFFFFFFF7;
v157 = v156 & 1;
if( (v156 & 1) == 0 && ((v156 & 2) != 0 || (v156 & 4) != 0) )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (unsigned int)PsIsSystemWideMitigationOptionSet(v148, 0x140000000ui64) )
{
LABEL_755:
v13 = -1073741637;
goto LABEL_756;
}
if( ProcessHandle == (PVOID)-1i64 )
goto LABEL_510;
v13 = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x200u,
(POBJECT_TYPE)PsProcessType,
v9,
0x79517350u,
&v268,
0i64);
if( v13 < 0 )
goto LABEL_481;
LOBYTE(v271) = 1;
v158 = (PVOID)PsGetCurrentProcess();
v149 = (__int64)v268;
if( v268 == v158 )
{
LABEL_510:
if( (v156 & 1) == 0 && (*(_DWORD *)(v149 + 2512) & 0x100) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v168 = (v156 >> 3) & 1;
if( !v168 && (v156 & 1) == 0 && (*(_DWORD *)(v149 + 2512) & 0x800) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v169 = (v156 >> 1) & 1;
if( v169 )
{
v170 = *(_DWORD *)(v149 + 2512);
if( (v170 & 0x100) != 0 && (v170 & 0x200) == 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
}
v171 = (v156 >> 2) & 1;
if( v171 )
{
v172 = *(_DWORD *)(v149 + 2512);
if( (v172 & 0x100) != 0 && (v172 & 0x400) == 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
}
if( v157 )
{
v173 = 2304;
}
else
{
v173 = 0;
if( v168 )
v173 = 2048;
}
v164 = v173 | 0x200;
if( !v169 )
v164 = v173;
v159 = (UINT64 *)(v149 + 2512);
v165 = v164;
LODWORD(v165) = v164 | 0x400;
v166 = v171 == 0;
}
else
{
v159 = (UINT64 *)((char *)v268 + 2512);
v160 = *((_DWORD *)v268 + 628);
if( (v160 & 0x100) != 0 )
{
memset(&SubjectContext, 0, sizeof(SubjectContext));
SeCaptureSubjectContextEx(0i64, (_EPROCESS *)v268, &SubjectContext);
IsSandboxedToken = RtlIsSandboxedToken(&SubjectContext, 1);
SeReleaseSubjectContext(&SubjectContext);
if( ((unsigned __int8)RtlIsSandboxedToken(0i64, v9) || !IsSandboxedToken || (*(_DWORD *)v159 & 0x400) == 0)
&& !SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) )
{
goto LABEL_437;
}
}
else if( (v156 & 8) == 0 && (v156 & 1) == 0 && (v160 & 0x800) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v162 = -v157;
v163 = (v162 != 0 ? 0x100 : 0) | 0x800;
if( (v156 & 8) == 0 )
v163 = v162 != 0 ? 0x900 : 0;
v164 = v163 | 0x200;
if( ((v156 >> 1) & 1) == 0 )
v164 = v163;
v165 = v164;
LODWORD(v165) = v164 | 0x400;
v167 = (v156 >> 2) & 1;
v166 = v167 == 0;
}
if( v166 )
v165 = v164;
RtlInterlockedSetClearBits(v159, v165);
v13 = 0;
goto LABEL_756;
case 3:
if( (v272 & 0xFFFFFFFC00000000ui64) != 0 )
{
v13 = -1073741811;
}
else if( ((HIDWORD(v272) >> 1) & 1) != 0 || (v272 & 0x100000000i64) == 0 )
{
if( ((HIDWORD(v272) >> 1) & 1) == 0 || (v272 & 0x100000000i64) != 0 )
{
v152 = (_HANDLE_TABLE *)ObReferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)v149);
if( v152 )
{
v13 = -1073741790;
if( ExEnableHandleExceptions(v152, BYTE4(v272) & 1) )
v13 = 0;
ObDereferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)v149);
}
else
{
v13 = -1073741558;
}
}
else
{
v13 = -1073741811;
}
}
else
{
v13 = -1073741811;
}
goto LABEL_756;
case 4:
v153 = HIDWORD(v272);
if( (v272 & 0xFFFFFFFC00000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) != 0 && (v272 & 0x200000000i64) != 0 )
{
v153 = HIDWORD(v272) & 0xFFFFFFFD;
HIDWORD(v272) &= ~2u;
}
v154 = v153 & 1;
if( (v153 & 1) == 0 && (*(_DWORD *)(v149 + 2512) & 0x1000) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v155 = (v153 >> 1) & 1;
if( v155 )
goto LABEL_473;
if( v154 )
goto LABEL_475;
if( (*(_DWORD *)(v149 + 2512) & 0x2000) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
LABEL_473:
if( !v154 && !v155 )
goto LABEL_477;
LABEL_475:
if( PsIsGuiThread((PETHREAD)a11) )
{
v13 = -1073741431;
}
else
{
LABEL_477:
v13 = 0;
if( v154 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 0x3000u);
v149 = (__int64)v268;
}
else if( v155 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 0x2000u);
LABEL_481:
v149 = (__int64)v268;
}
}
goto LABEL_756;
case 6:
if( (v272 & 0xFFFFFFFE00000000ui64) != 0 )
{
v13 = -1073741811;
}
else if( (v272 & 0x100000000i64) != 0 || (*(_DWORD *)(v149 + 2512) & 0x80u) == 0 )
{
v13 = 0;
if( (v272 & 0x100000000i64) != 0 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 0x80u);
v149 = (__int64)v268;
}
}
else
{
v13 = -1073741790;
}
goto LABEL_756;
case 7:
if( (v272 & 0xFFFFFFF800000000ui64) != 0 )
{
v13 = -1073741811;
}
else if( (*(_DWORD *)(v149 + 2512) & 1) != 0 )
{
if( (v272 & 0x400000000i64) != 0 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 4u);
v13 = 0;
v149 = (__int64)v268;
}
else
{
v13 = -1073741790;
}
}
else
{
v13 = -1073741790;
}
goto LABEL_756;
case 8:
v174 = HIDWORD(v272);
if( (v272 & 0xFFFFFFE000000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) != 0 && ((v272 & 0x800000000i64) != 0 || (v272 & 0x1000000000i64) != 0) )
v174 = HIDWORD(v272) & 0xFFFFFFE7;
if( (v174 & 2) != 0 && (v174 & 0x10) != 0 )
v174 &= ~0x10u;
v175 = (v174 >> 3) & 1;
if( v175 && (v174 & 0x10) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
v176 = (v174 >> 1) & 1;
if( (v174 & 1) + v176 > 1 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v174 & 1) != 0 )
goto LABEL_570;
if( *(_BYTE *)(v149 + 2168) >= 8u && *(_BYTE *)(v149 + 2169) >= 8u )
{
v13 = -1073741790;
goto LABEL_756;
}
if( !v176
&& (unsigned int)SeCompareSigningLevels(*(_BYTE *)(v149 + 2168), 6u)
&& (unsigned int)SeCompareSigningLevels(*(_BYTE *)(v149 + 2169), 6u) )
{
v13 = -1073741790;
goto LABEL_756;
}
LABEL_570:
if( (*(_DWORD *)(v149 + 2512) & 0x3000000) != 0 && (v174 & 0x10) == 0 && !v176 && !v175 && (v174 & 1) == 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v13 = 0;
if( (v174 & 1) != 0 )
{
if( *(_BYTE *)(v149 + 2168) < 8u )
*(_BYTE *)(v149 + 2168) = 8;
if( *(_BYTE *)(v149 + 2169) < 8u )
*(_BYTE *)(v149 + 2169) = 8;
}
else if( v176 )
{
if( !(unsigned int)SeCompareSigningLevels(*(_BYTE *)(v149 + 2168), 6u) )
{
v13 = -1073741790;
goto LABEL_756;
}
if( (unsigned int)SeCompareSigningLevels(6u, *(_BYTE *)(v149 + 2169)) )
*(_BYTE *)(v149 + 2169) = 6;
}
if( v174 )
v7 = 0x800000;
v177 = v7 | 0x1000000;
if( !v175 )
v177 = v7;
v178 = v177;
LODWORD(v178) = v177 | 0x2000000;
if( ((v174 >> 4) & 1) == 0 )
v178 = v177;
RtlInterlockedSetClearBits((UINT64 *)(v149 + 2512), v178);
goto LABEL_756;
case 9:
if( (v272 & 0xFFFFFFFC00000000ui64) != 0 )
{
v13 = -1073741811;
}
else if( (v272 & 0x100000000i64) != 0 || (*(_DWORD *)(v149 + 2512) & 0x10000) == 0 )
{
if( (v272 & 0x100000000i64) != 0 || (v272 & 0x200000000i64) != 0 || (*(_DWORD *)(v149 + 2512) & 0x20000) == 0 )
{
v13 = 0;
if( (v272 & 0x100000000i64) != 0 )
{
RtlInterlockedSetClearBits((UINT64 *)(v149 + 2512), 0x10000ui64);
}
else if( (v272 & 0x200000000i64) != 0 )
{
RtlInterlockedSetClearBits((UINT64 *)(v149 + 2512), 0x20000ui64);
}
}
else
{
v13 = -1073741790;
}
}
else
{
v13 = -1073741790;
}
goto LABEL_756;
case 10:
v179 = HIDWORD(v272);
if( (v272 & 0xFFFFFFE000000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) != 0 && (v272 & 0x800000000i64) != 0 )
v179 = HIDWORD(v272) & 0xFFFFFFF7;
if( (v179 & 2) != 0 && (v179 & 0x10) != 0 )
v179 &= ~0x10u;
v180 = v179 & 1;
v181 = 0x80000;
if( (v179 & 1) == 0 && (*(_DWORD *)(v149 + 2512) & 0x80000) != 0 )
goto LABEL_437;
v182 = (v179 >> 1) & 1;
if( !v182 && (*(_DWORD *)(v149 + 2512) & 0x200000) != 0 )
goto LABEL_437;
v183 = (v179 >> 2) & 1;
if( !v183 && (*(_DWORD *)(v149 + 2512) & 0x40000) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v184 = (v179 >> 3) & 1;
if( !v184 && (v179 & 1) == 0 && (*(_DWORD *)(v149 + 2512) & 0x100000) != 0 )
goto LABEL_437;
v185 = (v179 >> 4) & 1;
if( v185 || v182 || (*(_DWORD *)(v149 + 2512) & 0x400000) == 0 )
{
if( !v180 )
{
v181 = 0;
if( v184 )
v181 = 0x100000;
}
if( v182 )
{
v181 |= 0x200000u;
}
else if( v185 )
{
v181 |= 0x400000u;
}
v186 = v181;
LODWORD(v186) = v181 | 0x40000;
if( !v183 )
v186 = v181;
RtlInterlockedSetClearBits((UINT64 *)(v149 + 2512), v186);
v13 = 0;
}
else
{
v13 = -1073741790;
}
goto LABEL_756;
case 13:
v187 = HIDWORD(v272);
if( (v272 & 0xFFFFFFF800000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) == 0 && (v272 & 0x400000000i64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) != 0 && (v272 & 0x200000000i64) != 0 )
v187 = HIDWORD(v272) & 0xFFFFFFFD;
NoChildProcessRestrictedPolicy = PspGetNoChildProcessRestrictedPolicy(v149);
v189 = NoChildProcessRestrictedPolicy;
v190 = v187 & 1;
if( (v187 & 1) == 0 && (unsigned int)(NoChildProcessRestrictedPolicy - 1) <= 1 )
{
v13 = -1073741790;
goto LABEL_756;
}
v191 = (v187 >> 2) & 1;
if( v191 && v189 == 1 )
{
v13 = -1073741790;
goto LABEL_756;
}
v192 = (v187 >> 1) & 1;
if( v192 )
goto LABEL_656;
if( v190 )
goto LABEL_657;
if( v189 == 3 )
{
v13 = -1073741790;
goto LABEL_756;
}
LABEL_656:
if( v190 )
{
LABEL_657:
if( v191 )
PspSetNoChildProcessRestrictedPolicy(v149, 2);
else
PspSetNoChildProcessRestrictedPolicy(v149, 1);
v13 = 0;
}
else
{
if( !v192 )
goto LABEL_447;
PspSetNoChildProcessRestrictedPolicy(v149, 3);
v13 = 0;
}
goto LABEL_756;
case 14:
if( (v272 & 0xFFFFFFF000000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) == 0 && (*(_DWORD *)(v149 + 2512) & 0x40000000) != 0
|| ((HIDWORD(v272) >> 1) & 1) == 0 && *(int *)(v149 + 2512) < 0
|| ((HIDWORD(v272) >> 3) & 1) == 0 && (*(_DWORD *)(v149 + 2516) & 0x2000) != 0 )
{
goto LABEL_437;
}
v197 = (HIDWORD(v272) >> 2) & 1;
if( v197 || (*(_DWORD *)(v149 + 2516) & 0x1000) == 0 )
{
if( (v272 & 0x100000000i64) != 0 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 0x40000000u);
v149 = (__int64)v268;
}
if( ((HIDWORD(v272) >> 1) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2512), 0x80000000);
_InterlockedOr((volatile signed __int32 *)v268 + 543, 0x200000u);
v149 = (__int64)v268;
PspWriteProcessSecurityDomain((INT64)v268, _InterlockedIncrement64(&PsNextSecurityDomain), 1i64);
KeSynchronizeSecurityDomain(v198);
}
if( v197 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x1000u);
v149 = (__int64)v268;
}
if( ((HIDWORD(v272) >> 3) & 1) != 0 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x2000u);
v149 = (__int64)v268;
}
v13 = 0;
}
else
{
v13 = -1073741790;
}
goto LABEL_756;
case 15:
v199 = HIDWORD(v272);
if( (v272 & 0xFFFFFC0000000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x1000000000i64) != 0 )
{
v199 = HIDWORD(v272) | 1;
HIDWORD(v272) |= 1u;
}
if( (v199 & 0x200) != 0 )
{
v199 |= 4u;
HIDWORD(v272) = v199;
}
if( (v199 & 0x40) != 0 )
{
v199 |= 0x20u;
HIDWORD(v272) = v199;
}
v200 = (v199 >> 4) & 1;
if( !v200 && (*(_DWORD *)(v149 + 2516) & 0x100000) != 0
|| (v199 & 1) == 0 && (*(_DWORD *)(v149 + 2516) & 0x4000) != 0 )
{
goto LABEL_437;
}
if( (v199 & 1) != 0 && (*(_DWORD *)(v149 + 2516) & 0x4000) == 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v201 = (v199 >> 9) & 1;
if( v201 && *(int *)(v149 + 2516) >= 0 )
goto LABEL_437;
v202 = (v199 >> 2) & 1;
if( !v202 && (*(_DWORD *)(v149 + 2516) & 0x20000) != 0 )
goto LABEL_437;
if( v202 && (*(_DWORD *)(v149 + 2516) & 0x20000) == 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v203 = (v199 >> 6) & 1;
if( !v203 && (*(_DWORD *)(v149 + 2516) & 0x400000) != 0 )
goto LABEL_437;
v204 = (v199 >> 5) & 1;
if( !v204 && (*(_DWORD *)(v149 + 2516) & 0x200000) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
v205 = (v199 >> 8) & 1;
if( !v205 && (*(_DWORD *)(v149 + 2516) & 0x40000000) != 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
if( ((v199 >> 1) & 1) == 0 && (*(_DWORD *)(v149 + 2516) & 0x8000) != 0
|| ((v199 >> 1) & 1) != 0 && (*(_DWORD *)(v149 + 2516) & 0x8000) == 0
|| ((v199 >> 3) & 1) == 0 && (*(_DWORD *)(v149 + 2516) & 0x40000) != 0
|| ((v199 >> 3) & 1) != 0 && (*(_DWORD *)(v149 + 2516) & 0x40000) == 0
|| (v206 = (v199 >> 7) & 1) == 0 && (*(_DWORD *)(v149 + 2516) & 0x800000) != 0 )
{
LABEL_437:
v13 = -1073741790;
goto LABEL_756;
}
if( v206 && (*(_DWORD *)(v149 + 2516) & 0x800000) == 0 )
{
v13 = -1073741790;
goto LABEL_756;
}
if( v200 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x100000u);
v149 = (__int64)v268;
}
if( !v201 && v202 )
{
_InterlockedAnd((volatile signed __int32 *)(v149 + 2516), 0x7FFFFFFFu);
v149 = (__int64)v268;
}
if( v203 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x200000u);
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x400000u);
}
else
{
if( !v204 )
goto LABEL_752;
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x200000u);
}
v149 = (__int64)v268;
LABEL_752:
if( v205 )
{
_InterlockedOr((volatile signed __int32 *)(v149 + 2516), 0x40000000u);
v149 = (__int64)v268;
}
v13 = 0;
LABEL_756:
if( (_BYTE)v271 != 1 )
return v13;
LABEL_757:
ObfDereferenceObjectWithTag((PVOID)v149, 0x79517350ui64);
return v13;
case 16:
v193 = HIDWORD(v272);
if( (v272 & 0xFFFFFFFC00000000ui64) != 0 )
{
v13 = -1073741811;
goto LABEL_756;
}
if( (v272 & 0x100000000i64) != 0 && (v272 & 0x200000000i64) != 0 )
v193 = HIDWORD(v272) & 0xFFFFFFFD;
RedirectionTrustPolicy = PspGetRedirectionTrustPolicy(v149);
v195 = v193 & 1;
if( (v193 & 1) == 0 && RedirectionTrustPolicy == 1 )
{
v13 = -1073741790;
goto LABEL_756;
}
v196 = (v193 >> 1) & 1;
if( v196 )
goto LABEL_675;
if( v195 )
goto LABEL_676;
if( RedirectionTrustPolicy == 2 )
{
v13 = -1073741790;
}
else
{
LABEL_675:
if( v195 )
{
LABEL_676:
PspSetRedirectionTrustPolicy(v149, 1);
v13 = 0;
}
else if( v196 )
{
PspSetRedirectionTrustPolicy(v149, 2);
v13 = 0;
}
else
{
LABEL_447:
v13 = 0;
}
}
goto LABEL_756;
default:
goto LABEL_755;
}
}Referenced by:
No references.