BuildQueryDirectoryIrp
__int64 BuildQueryDirectoryIrp(void *a1, void *a2, ...){
_ETHREAD *CurrentThread;
INT8 v4;
unsigned int v5;
__int64 v6;
int v7;
unsigned __int64 v8;
UINT8 *PoolWithQuota;
UINT8 *v10;
__int16 v11;
UINT64 v13;
int v14;
UINT8 v15;
UINT8 v16;
char *v17;
void *v18;
_DWORD *v19;
_ETHREAD *v20;
volatile __int32 *v21;
__int64 v22;
char v23;
_BYTE *v24;
_DEVICE_OBJECT *RelatedDeviceObject;
IRP *v26;
POOL_TYPE v27;
IRP *v28;
__int64 v29;
int v30;
int v31;
UINT64 v32;
UINT8 v33;
UINT8 v34;
_WORD *v35;
_MDL *Mdl;
INT64 v37;
IRP *Irp;
IRP *Irpa;
PIRP Irpb;
char v41;
int v42;
PVOID Object;
PVOID P;
PADAPTER_OBJECT DmaAdapter;
PVOID VirtualAddress;
_ETHREAD *v47;
__int128 v48;
VOID *retaddr;
INT64 v51;
va_list va;
__int64 v53;
UINT64 *v54;
va_list va1;
volatile void *Address;
SIZE_T Length;
__int64 v58;
__int64 v59;
__int128 *v60;
__int64 v61;
_BYTE *v62;
_DEVICE_OBJECT **v63;
IRP **v64;
PVOID *v65;
PIRP v66;
va_list va2;
va_start(va2, a2);
va_start(va1, a2);
va_start(va, a2);
v51 = va_arg(va1, _QWORD);
v53 = va_arg(va1, _QWORD);
va_copy(va2, va1);
v54 = va_arg(va2, UINT64 *);
Address = va_arg(va2, volatile void *);
Length = va_arg(va2, _QWORD);
v58 = va_arg(va2, _QWORD);
v59 = va_arg(va2, _QWORD);
v60 = va_arg(va2, __int128 *);
v61 = va_arg(va2, _QWORD);
v62 = va_arg(va2, _BYTE *);
v63 = va_arg(va2, _DEVICE_OBJECT **);
v64 = va_arg(va2, IRP **);
v65 = va_arg(va2, PVOID *);
v66 = va_arg(va2, PIRP);
Object = 0i64;
DmaAdapter = 0i64;
P = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v47 = CurrentThread;
v4 = *((_BYTE *)CurrentThread + 562);
LOBYTE(v61) = v4;
*(_BYTE *)v66 = v4;
if( v4 )
{
v5 = 0;
v42 = 0;
v6 = (__int64)v54;
if( (unsigned __int64)v54 >= 0x7FFFFFFF0000i64 )
v6 = 0x7FFFFFFF0000i64;
*(_DWORD *)v6 = *(_DWORD *)v6;
v7 = v58;
if( (_DWORD)v58 == 1 )
{
v5 = 72;
}
else
{
if( (_DWORD)v58 != 3 )
{
switch( (int)v58 )
{
case 2:
case 29:
v5 = 72;
goto LABEL_7;
case 12:
case 33:
v5 = 16;
goto LABEL_7;
case 32:
v5 = 56;
goto LABEL_7;
case 37:
v5 = 112;
goto LABEL_7;
case 38:
v5 = 88;
goto LABEL_7;
case 50:
case 60:
v5 = 96;
goto LABEL_7;
case 63:
v5 = 120;
v42 = 120;
break;
default:
break;
}
if( !v5 )
return 3221225475i64;
goto LABEL_8;
}
v5 = 96;
}
LABEL_7:
v42 = v5;
LABEL_8:
if( (unsigned int)Length < v5 )
return 3221225476i64;
if( *(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1408i64) )
ProbeForWrite((VOID *)Address, (unsigned int)Length, 4ui64);
else
ProbeForWrite(
(VOID *)Address,
(unsigned int)Length,
*((unsigned __int8 *)IopQuerySetAlignmentRequirement + (int)v58));
goto LABEL_11;
}
v7 = v58;
LABEL_11:
v8 = (unsigned __int64)v60;
if( !v60 )
goto LABEL_12;
v48 = 0i64;
if( v4 )
{
if( (unsigned __int64)v60 >= 0x7FFFFFFF0000i64 )
v8 = 0x7FFFFFFF0000i64;
LODWORD(v48) = *(_DWORD *)v8;
v10 = *(UINT8 **)(v8 + 8);
*((_QWORD *)&v48 + 1) = v10;
}
else
{
v48 = *v60;
v10 = (UINT8 *)*((_QWORD *)&v48 + 1);
}
if( (v48 & 1) != 0 )
return 3221225485i64;
v11 = v48;
if( (_WORD)v48 )
{
if( v4 )
{
v8 = (unsigned __int64)&v10[(unsigned __int16)v48];
if( v8 > 0x7FFFFFFF0000i64 || v8 < (unsigned __int64)v10 )
MEMORY[0x7FFFFFFF0000] = 0;
if( (unsigned __int16)v48 >= 0x200u )
RtlRaiseStatus(-1073741811);
}
PoolWithQuota = (UINT8 *)IopVerifierExAllocatePoolWithQuota((POOL_TYPE)v8, (unsigned __int16)v48 + 16i64);
P = PoolWithQuota;
memmove(PoolWithQuota + 16, v10, (unsigned __int16)v48);
*(_WORD *)PoolWithQuota = v48;
*((_WORD *)PoolWithQuota + 1) = v11;
*((_QWORD *)PoolWithQuota + 1) = PoolWithQuota + 16;
v4 = v61;
}
else
{
LABEL_12:
PoolWithQuota = (UINT8 *)P;
}
v14 = IopReferenceFileObject(a1, 1ui64, v4, (FILE_OBJECT **)&Object, 0i64);
if( v14 < 0 )
{
if( PoolWithQuota )
ExFreePoolWithTag(PoolWithQuota, 0);
return(unsigned int)v14;
}
v17 = (char *)Object;
*v65 = Object;
if( *((_QWORD *)v17 + 22) && (v51 & 0xFFFFFFFFFFFFFFFEui64) != 0 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v17);
if( PoolWithQuota )
ExFreePoolWithTag(PoolWithQuota, 0);
return 3221225485i64;
}
if( a2 )
{
VirtualAddress = 0i64;
v14 = ObReferenceObjectByHandle(a2, 2u, (POBJECT_TYPE)ExEventObjectType, v4, &VirtualAddress, 0i64);
v18 = VirtualAddress;
DmaAdapter = (PADAPTER_OBJECT)VirtualAddress;
if( v14 < 0 )
{
if( PoolWithQuota )
ExFreePoolWithTag(PoolWithQuota, 0);
LABEL_87:
HalPutDmaAdapter((PADAPTER_OBJECT)v17);
return(unsigned int)v14;
}
KeResetEvent(VirtualAddress, v32, v33, v34, Irpa);
}
else
{
v18 = DmaAdapter;
}
v19 = v17 + 80;
if( (*((_DWORD *)v17 + 20) & 2) != 0 )
{
v20 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v20 + 242);
v21 = (volatile __int32 *)Object;
LODWORD(v22) = KeAbPreAcquire((char *)Object + 128, 0i64, 0i64);
v41 = 0;
if( _InterlockedExchange(v21 + 29, 1) )
{
Irp = (IRP *)&v41;
v23 = v61;
v17 = (char *)Object;
v14 = IopWaitAndAcquireFileObjectLock(Object, (unsigned __int8)v61);
}
else
{
if( v22 )
*(_BYTE *)(v22 + 26) |= 1u;
v17 = (char *)Object;
ObfReferenceObject(Object);
v14 = 0;
v23 = v61;
}
if( !v41 )
{
v24 = v62;
*v62 = 1;
v18 = DmaAdapter;
PoolWithQuota = (UINT8 *)P;
goto LABEL_53;
}
if( P )
ExFreePoolWithTag(P, 0);
if( DmaAdapter )
HalPutDmaAdapter(DmaAdapter);
goto LABEL_87;
}
v24 = v62;
*v62 = 0;
v23 = v61;
if( (_BYTE)v61 )
IopMarkApcRoutineIfAsynchronousIo32((UINT64 **)va1, (INT64 *)va, 0);
LABEL_53:
if( (*v19 & 0x4000000) == 0 )
KeResetEvent(v17 + 152, v13, v15, v16, Irp);
RelatedDeviceObject = IoGetRelatedDeviceObject((_FILE_OBJECT *)v17);
*v63 = RelatedDeviceObject;
v26 = IopAllocateIrpExReturn(RelatedDeviceObject, *((_BYTE *)RelatedDeviceObject + 76), *v24 == 0, retaddr);
v28 = v26;
v66 = v26;
if( v26 )
{
*v64 = v26;
*((_QWORD *)v26 + 24) = v17;
*((_QWORD *)v26 + 19) = v47;
*((_BYTE *)v26 + 64) = v23;
*((_QWORD *)v26 + 10) = v18;
*((_QWORD *)v26 + 9) = v54;
*((_QWORD *)v26 + 11) = v51;
*((_QWORD *)v26 + 12) = v53;
v29 = *((_QWORD *)v26 + 23);
*(_WORD *)(v29 - 72) = 268;
*(_QWORD *)(v29 - 24) = v17;
*((_QWORD *)v26 + 20) = PoolWithQuota;
*((_QWORD *)v26 + 3) = 0i64;
*((_QWORD *)v26 + 1) = 0i64;
v30 = *((_DWORD *)RelatedDeviceObject + 12);
if( (v30 & 4) != 0 )
{
v31 = Length;
v35 = IopVerifierExAllocatePoolWithQuota(v27, (unsigned int)Length);
*((_QWORD *)v28 + 3) = v35;
if( !IopDisableBufferedIoInit )
memset((INT64)v35, 0i64);
*((_DWORD *)v28 + 4) = 112;
}
else
{
if( (v30 & 0x10) != 0 )
{
v31 = Length;
Mdl = IoAllocateMdl((PVOID)Address, Length, 0, 1u, v28);
if( !Mdl )
RtlRaiseStatus(-1073741670);
LODWORD(Irpb) = *(unsigned __int8 *)(v29 - 72);
IopProbeAndLockPages_1(Mdl, v61, v37, RelatedDeviceObject, (INT64)Irpb);
goto LABEL_60;
}
v31 = Length;
}
*((_QWORD *)v28 + 14) = Address;
LABEL_60:
*(_DWORD *)(v29 - 64) = v31;
*(_DWORD *)(v29 - 48) = v7;
*(_DWORD *)(v29 - 40) = 0;
*(_QWORD *)(v29 - 56) = PoolWithQuota;
*(_BYTE *)(v29 - 70) = v59 & 0x1B;
*((_DWORD *)v28 + 4) |= 0x800u;
return 0i64;
}
IopAllocateIrpCleanup((PUNICODE_STRING)v17);
if( PoolWithQuota )
ExFreePoolWithTag(PoolWithQuota, 0);
return 3221225626i64;
}Referenced by:
NtQueryDirectoryFileEx